CVE-2026-50233

Name of the Vulnerable Software and Affected Versions Lyrion Music Server version 9.2.0

Description An arbitrary directory listing issue exists in the readdirectory query, which is accessible via the CLI service on TCP port 9090 and the HTTP JSON-RPC endpoint "/jsonrpc.js". The query utilizes a folder parameter to list directory contents without restricting access to configured media directories. In the default configuration, this process requires no authentication, enabling a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.