Is CVE-2026-50234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50234 being exploited in the wild.

How severe is CVE-2026-50234?

High severity, with a CVSS score of 7.5, published 5 June 2026.

Is there a fix for CVE-2026-50234?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50234 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50234?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50234: Lyrion Music Server path traversal in web server

CVE-2026-50234 · Severity: high · CVSS 7.5 · Published 2026-06-05

Lyrion Music Server, a platform used for managing and streaming digital music collections, contains a security flaw that allows unauthorized individuals to access files on the host system. By sending specially crafted requests to the server's web interface, an attacker can bypass security restrictions to read sensitive configuration files or system data. This could lead to the exposure of private information or credentials, potentially compromising the security of the entire device or network where the server is hosted.

Quick answers

Is CVE-2026-50234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50234 being exploited in the wild.
How severe is CVE-2026-50234?: High severity, with a CVSS score of 7.5, published 5 June 2026.
Which products and versions are affected?: Lyrion Music Server <= 9.2.0.
Is there a fix for CVE-2026-50234?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50234 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50234?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the web server component of Lyrion Music Server version 9.2.0 and below. The application fails to properly sanitize file path parameters, allowing an unauthenticated attacker to use 'dot-dot-slash' (../) sequences to navigate outside of the intended web root directory. By exploiting this, a remote attacker can access sensitive files on the host filesystem that the web server process has permissions to read. The vulnerability is reachable over the network without user interaction or prior authentication. As of the advisory date, users should ensure they are running the latest patched version or restrict network access to the management interface.

Affected products

Lyrion Music Server <= 9.2.0

Timeline

2026-06-05: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
2026-06-05: advisory: CVE-2026-50234 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.