CVE-2026-48559: Lightweight Music Server XSS Vulnerability

CVE-2026-48559 Overview

CVE-2026-48559 is a stored cross-site scripting (XSS) vulnerability in Lightweight Music Server (LMS) through version 3.76.0. The flaw allows attackers to execute arbitrary JavaScript by embedding malicious HTML in media file metadata tags such as GENRE, ARTIST, or ALBUM. When LMS scans a crafted media file into a victim's library, the payload is stored and later rendered in the web interface without sanitization. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers who can place a crafted media file into a scanned library trigger arbitrary script execution against any user browsing the affected metadata in the LMS web UI.

Affected Products

Lightweight Music Server (LMS) through version 3.76.0
Web interface component rendering metadata tags via src/lms/ui/Utils.cpp
Library scanner component that ingests media file tag content

Discovery Timeline

2026-06-01 - CVE-2026-48559 published to the National Vulnerability Database
2026-06-01 - CVE record last modified in NVD

Technical Details for CVE-2026-48559

Vulnerability Analysis

LMS reads metadata tags from media files during library scanning and persists the raw values in its database. When the web interface renders these tag values, it passes them to the Wt web toolkit using the Wt::TextFormat::UnsafeXHTML format. This format instructs the framework to treat the supplied string as trusted XHTML and bypass output encoding. Any HTML or JavaScript embedded in a tag is therefore rendered as live markup in the user's browser session.

Because the payload is stored once and executed on every render, multiple users can be affected by a single malicious file. Execution occurs in the context of the LMS origin, exposing session cookies, CSRF tokens, and authenticated API calls to attacker-controlled JavaScript.

Root Cause

The root cause is the use of Wt::TextFormat::UnsafeXHTML in src/lms/ui/Utils.cpp to render user-controlled metadata. The code path emits tag values directly into the DOM without HTML entity encoding or allow-list filtering. No sanitization is performed during ingestion either, so the dangerous content persists in storage.

Attack Vector

An attacker prepares a media file with a crafted GENRE, ARTIST, or ALBUM tag containing HTML such as a <script> element or an event handler attribute. The file is introduced into a directory monitored by LMS, either by a user with library write access, through a shared folder, or via any upload path the deployment permits. On the next library scan, LMS persists the payload. When any user views a page that displays the malicious tag, the script executes in their browser.

For technical specifics, refer to the VulnCheck Advisory on XSS and the Zero Science Advisory ZSL-2026-5987.

Detection Methods for CVE-2026-48559

Indicators of Compromise

Media files in the LMS library whose GENRE, ARTIST, or ALBUM tags contain <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound HTTP requests from browsers of users who recently visited LMS album, artist, or genre views
New or modified media files appearing in scanned directories from accounts that do not normally write to the library
LMS scan logs showing ingestion of files with anomalously long or HTML-bearing tag values

Detection Strategies

Scan the LMS metadata database for tag values matching HTML or JavaScript patterns using regular expressions such as <[^>]+on[a-z]+= or <script
Run ffprobe or mediainfo across the library and flag files whose textual tags contain angle brackets or URL schemes
Monitor the LMS web server access logs for requests to endpoints rendering tag content followed by anomalous client-side fetches to external hosts

Monitoring Recommendations

Enable browser Content Security Policy reporting in front of LMS to surface blocked inline script attempts
Alert on new file additions to monitored library paths from non-administrative users or service accounts
Track HTTP referrers and user-agent activity originating from LMS sessions to identify post-XSS callback traffic

How to Mitigate CVE-2026-48559

Immediate Actions Required

Restrict write access to LMS library directories to trusted administrators until a patched build is deployed
Audit existing media files for HTML or script content in metadata tags and quarantine any matches
Force re-authentication and invalidate active LMS sessions to limit exposure if exploitation is suspected

Patch Information

At the time of publication, no fixed release is referenced in the NVD record. Track the upstream fix progress through the GitHub Issue Discussion and the GitHub Milestone Overview. Upgrade to a release later than 3.76.0 once the maintainers ship a build that sanitizes tag content or switches rendering away from Wt::TextFormat::UnsafeXHTML.

Workarounds

Place LMS behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts and external script sources
Sanitize media metadata before files are written to scanned directories using a script that strips HTML from GENRE, ARTIST, and ALBUM tags
Limit LMS to a single-user deployment or expose it only over a trusted network until an upstream fix is available

bash

# Example: strip HTML-bearing tags from FLAC files before ingestion
find /var/lib/lms/library -name '*.flac' -print0 | \
  xargs -0 -I{} sh -c 'metaflac --remove-tag=GENRE --remove-tag=ARTIST --remove-tag=ALBUM "{}"'