CVE-2026-50233
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jun 5, 2026
CISA due date
—
The record
Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19987 A security vulnerability has been detected in SourceCodester Best Employee Management… CWE-548
- CVE-2025-32750 Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through… CWE-548
- CVE-2026-41933 Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability… CWE-548
- CVE-2026-22860 Rack is a modular Ruby web server interface. CWE-548
- CVE-2023-38265 IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose… CWE-548
- CVE-2020-36921 RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability… CWE-548
- GHSA-c5cj-xp43-qcc3 Moodle's error handling leads to sensitive information disclosure CWE-548
- CVE-2025-62396 Moodle's error handling leads to sensitive information disclosure CWE-548