Executive brief
Lyrion Music Server is a media streaming platform used to manage and play music across various devices. A security flaw in its logging system allows attackers to inject malicious scripts that execute when an administrator views the server logs. This could lead to unauthorized actions being performed in the administrator's browser, potentially compromising the server management interface or user data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Lyrion Music Server version 9.2.0 and earlier within the log viewer component. The application fails to properly sanitize input before it is rendered in the web-based log interface, specifically targeting unescaped template variables. Attackers can trigger the vulnerability by providing malicious payloads through URL query parameters (search, lines, path) or by forcing the server to log crafted strings such as malicious User-Agent headers, stream titles, or player names. Because the logging of these values can often be triggered without authentication, a remote attacker can store a script that executes in the context of any user (typically an administrator) who later views the server logs.
Affected products
- Lyrion Music Server <= 9.2.0
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory