Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS

[zeroscience]

Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS


Vendor: LMS Community
Product web page: https://www.lyrion.org
Affected version 9.2.0

Summary: Lyrion Music Server (formerly Logitech Media Server, and
often abbreviated as "LMS" ) is open-source software which can control
and serve (stream) music to a wide range of physical and virtual audio
players called Squeezeboxes. Lyrion Music Server can stream your local
music collection, internet radio stations, and content from many streaming
services (with and without subscriptions).

Desc: Lyrion Music Server suffers from an unauthenticated reflected cross-site
scripting vulnerability through 'server.log' endpoint abusing the 'search' GET
parameter. Input is not properly sanitized before being returned to the user,
allowing the execution of arbitrary HTML/JS code in a user's browser session
in the context of the affected site.

Tested on: Windows 10 (64-bit) - EN
           Lyrion Music Server (9.2.0 - 1779973211)
           Perl/5.32.1
           SQLite


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2026-5988
Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-5988
CVE ID: CVE-2026-50230
CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-50230


27.05.2026

--


http://localhost:9000/server.log?search=">XSS_HERE!

ZSL-2026-5988: Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS

ZSL-2026-5988: Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS

www.zeroscience.mk