CVE-2026-50234: Lyrion Music Server 9.2.0 Path Traversal File Read

Synopsis

A path traversal vulnerability in Lyrion Music Server 9.2.0 allows unauthenticated attackers to read arbitrary files from the host filesystem by manipulating file path parameters in the server's web interface. The vulnerability is reachable over the network and requires no credentials, making it trivially accessible to any attacker who can reach the service. Successful exploitation allows an attacker to read sensitive files outside the intended directory, including configuration files, credentials, and other data stored on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Lyrion Music Server web interface over the network; no local access or special positioning is needed beyond TCP reachability to the service port.

• AuthenticationNot required

  No credentials are required; the path traversal endpoint is accessible to any unauthenticated client that can reach the service.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the affected server.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layout, or environmental prerequisites are needed to read arbitrary files.

Blast Radius

• Reads arbitrary files from the host filesystem, including application configuration files that may contain database credentials, API keys, or service account tokens.
• Reads OS-level files such as /etc/passwd or private key material stored on disk, which can be used to pivot to further compromise.
• Leaks the full directory structure of the host, giving an attacker a detailed map of installed software and data paths for follow-on attacks.