CVE-2026-50231

Name of the Vulnerable Software and Affected Versions Lyrion Music Server version 9.2.0

Description An unauthenticated stored cross-site scripting issue exists in the log viewer due to unescaped template variables. This allows attackers to execute arbitrary scripts in users' browsers by injecting payloads through the search, lines, and path query parameters. Additionally, scripts can be injected by crafting values that are recorded in the logs, such as URLs, User-Agent headers, stream titles, or player names.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.