CVE-2026-50233: Lyrion Music Server 9.2.0 Arbitrary Directory Enumeration Vulnerability

Technical summary

CVE-2026-50233 is an arbitrary directory enumeration vulnerability affecting Lyrion Music Server 9.2.0. The readdirectory query parameter fails to enforce access controls, permitting unauthenticated remote users to list directory contents outside the intended media library scope. The vulnerability is exposed via two attack surfaces: the CLI service listening on TCP port 9090 and the HTTP JSON-RPC endpoint at /jsonrpc.js. The server does not restrict queries to configured media directories by default, and the absence of authentication in the default configuration means any network-adjacent attacker can invoke the vulnerable function.

Business impact

Organizations deploying Lyrion Music Server 9.2.0 in network environments face information disclosure risk. Attackers can enumerate filesystem structure, locate sensitive files (such as configuration databases, private keys, or customer data), and use discovered paths as reconnaissance for follow-on attacks. This is particularly concerning if the music server shares a host with other applications or services, or if the underlying system contains non-media business data. The low barrier to exploitation—no authentication required—means the attack surface is broad.

Affected systems

Lyrion Music Server version 9.2.0 is affected. The vulnerability is exposed by default through both the CLI service (port 9090) and the HTTP JSON-RPC interface (/jsonrpc.js). Systems running this version on network-accessible hosts are at risk if default configurations are in place. Later versions or patched releases from the vendor should be consulted to determine if mitigation or patches are available.

Exploitability

Exploitation is straightforward and requires no authentication. An attacker with network access to either the CLI port (9090) or the HTTP endpoint can craft directory-listing queries using the readdirectory parameter to enumerate arbitrary paths. The CVSS 3.1 score of 5.3 (Medium) reflects the low complexity, network accessibility, and absence of required privileges; impact is limited to confidentiality (information disclosure) with no direct integrity or availability consequences. However, the reconnaissance value should not be underestimated—filesystem enumeration is often a precursor to privilege escalation or lateral movement attacks.

Remediation

Immediate actions include upgrading Lyrion Music Server to a patched version released by the vendor after the modification date of 2026-06-17. Verify against the vendor's official advisory for the specific version number. As an interim measure, restrict network access to port 9090 and the HTTP JSON-RPC endpoint using firewall rules, limiting access to trusted clients only. Enable authentication in the server configuration if available. Consider deploying the application in a network segment isolated from sensitive systems or data.

Patch guidance

Consult the Lyrion Music Server vendor advisory for patch availability and recommended upgrade paths from version 9.2.0. Apply patches in a test environment before production deployment to ensure compatibility with your deployment and any customizations. Monitor vendor release notes and security announcements for this product going forward.

Detection guidance

Monitor network logs for repeated requests to /jsonrpc.js or TCP port 9090 with readdirectory parameters, especially from untrusted sources. Web application firewalls (WAF) can be configured to detect and block JSON-RPC queries that invoke readdirectory with suspicious path traversal indicators. Inspect server logs for enumeration patterns: rapid successive queries targeting common system directories (/etc, /home, /var, /root, Windows equivalents) may indicate active exploitation. Baseline normal API usage and alert on deviations.

Why prioritize this

Although the CVSS score is Medium (5.3), prioritize patching based on network exposure and the presence of sensitive data. If the music server is internet-facing or accessible from untrusted networks, elevate priority. If it runs in an isolated LAN with strong egress monitoring, the risk is lower but should not be deferred. Information disclosure vulnerabilities are often chained with other flaws; removing this reconnaissance vector reduces overall attack surface.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium severity) reflects Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, and limited impact to Confidentiality. The score appropriately captures the ease of exploitation and the information disclosure risk but does not account for the strategic value of reconnaissance in multi-stage attacks. Organizations should weigh the actual sensitivity of data on affected hosts when determining internal prioritization.

Frequently asked questions