CVE-2026-50234: Lyrion Music Server Path Traversal Flaw

CVE-2026-50234 Overview

CVE-2026-50234 is a path traversal vulnerability [CWE-22] affecting Lyrion Music Server version 9.2.0. The flaw resides in the web server component, where insufficient validation of file path parameters allows attackers to escape the intended directory structure. Unauthenticated remote attackers can read arbitrary files accessible to the service account by manipulating directory traversal sequences in HTTP requests. Exploitation requires no privileges, no user interaction, and is reachable over the network.

Critical Impact

Unauthenticated attackers can read arbitrary files from the host filesystem, exposing configuration data, credentials, and other sensitive resources accessible to the Lyrion Music Server process.

Affected Products

• Lyrion Music Server 9.2.0

Discovery Timeline

• 2026-06-05 - CVE-2026-50234 published to the National Vulnerability Database (NVD)
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-50234

Vulnerability Analysis

The vulnerability stems from improper neutralization of path traversal sequences within HTTP request parameters handled by the Lyrion Music Server web interface. The application accepts user-supplied file path values and uses them to construct filesystem paths without canonicalization or sandboxing against an allowed base directory.

Attackers submit crafted requests containing ../ sequences or absolute path references to escape the application's intended content directory. The server resolves these paths and returns the contents of files outside the music library scope. Because the endpoint does not require authentication, exploitation occurs directly against any network-reachable instance.

Returned content varies by host configuration but typically includes system configuration files, application credentials, and operating system files such as /etc/passwd on Linux or files under C:\Windows\ on Windows installations. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing input validation on file path parameters passed to the web server handler. The code does not normalize the requested path, does not enforce a chroot-style base directory, and does not reject traversal sequences before performing filesystem operations.

Attack Vector

Exploitation is performed over the network against the HTTP service exposed by Lyrion Music Server. An attacker issues a single crafted GET request containing traversal sequences in a file path parameter. No credentials or prior session are required. Refer to the VulnCheck Security Advisory and the Zero Science Vulnerability ZSL-2026-5992 for request-level technical details.

Detection Methods for CVE-2026-50234

Indicators of Compromise

• HTTP requests to the Lyrion Music Server containing ../, ..\, URL-encoded variants (%2e%2e%2f), or double-encoded traversal sequences in path or query parameters.
• Access log entries showing requests for files outside the configured music library, such as /etc/passwd, /etc/shadow, or Windows system files.
• Outbound responses from the music server containing file contents inconsistent with normal media streaming traffic.

Detection Strategies

• Inspect web server access logs for traversal patterns targeting the Lyrion HTTP endpoint and alert on any successful 200 responses to such requests.
• Deploy WAF or IDS signatures that match directory traversal payloads in URL parameters destined for the music server port.
• Correlate unauthenticated requests against sensitive file paths with the source IP across additional reconnaissance behavior.

Monitoring Recommendations

• Monitor process-level file reads by the Lyrion Music Server service for accesses outside its expected content directories.
• Track network egress from the Lyrion host for unusual response sizes or content types that indicate file exfiltration.
• Enable verbose HTTP request logging on the music server and forward logs to a centralized SIEM for retention and analysis.

How to Mitigate CVE-2026-50234

Immediate Actions Required

• Restrict network access to the Lyrion Music Server web interface using firewall rules, allowing only trusted management subnets.
• Remove any internet exposure of the service until a vendor-supplied patch is applied.
• Audit the host for evidence of file reads consistent with traversal exploitation, including credential and configuration file access.

Patch Information

No vendor patch information is available in the referenced advisories at the time of publication. Monitor the VulnCheck Security Advisory and the Zero Science Vulnerability ZSL-2026-5992 for updates and apply any released fix as soon as it becomes available.

Workarounds

• Bind the Lyrion Music Server listener to localhost or a private interface and front it with an authenticating reverse proxy.
• Run the service under a least-privileged user account that cannot read sensitive system files or other users' data.
• Apply OS-level mandatory access controls such as AppArmor or SELinux to constrain the process to its expected file paths.

# Example iptables rule restricting Lyrion Music Server access to a management subnet
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP