Is CVE-2026-50232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50232 being exploited in the wild.

How severe is CVE-2026-50232?

High severity, with a CVSS score of 7.2, published 5 June 2026.

Is there a fix for CVE-2026-50232?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50232 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50232?

Check whether you run Lyrion Music Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50232: Lyrion Music Server stored XSS via media metadata tags

CVE-2026-50232 · Severity: high · CVSS 7.2 · Published 2026-06-05

Lyrion Music Server, a platform used for managing and streaming digital music collections, is vulnerable to a security flaw where malicious code can be hidden inside music file information. If a user adds a specially crafted music file to their library, an attacker could remotely execute scripts in the user's web browser when they view the track details. This could allow an attacker to gain unauthorized access to server management functions, change settings, or steal sensitive configuration data.

Technologies: Lyrion Music Server. Vendors: Lyrion.

Quick answers

Is CVE-2026-50232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50232 being exploited in the wild.
How severe is CVE-2026-50232?: High severity, with a CVSS score of 7.2, published 5 June 2026.
Which products and versions are affected?: Lyrion Music Server <= 9.2.0.
Is there a fix for CVE-2026-50232?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50232 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50232?: Check whether you run Lyrion Music Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Lyrion Music Server version 9.2.0 and below. The application fails to properly sanitize metadata tags such as GENRE, ARTIST, and ALBUM within media files before displaying them in the web management interface. An attacker can craft a malicious media file containing XSS payloads in these tags; when the server processes the file and a user views the track information or plays the file via the web UI, the script executes in the context of the user's session. This can lead to unauthorized access to management functions and disclosure of server settings. The attack requires the server to index a malicious file but does not necessarily require prior authentication if the server is configured to monitor public or shared folders.

Affected products

Lyrion Lyrion Music Server <= 9.2.0

Timeline

2026-06-05: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
2026-06-05: advisory: CVE-2026-50232 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.