📄 Lyrion Music Server 9.2.0 server.log Reflected Cross Site Scripting

Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS
    
    
    Vendor: LMS Community
    Product web page: https://www.lyrion.org
    Affected version 9.2.0
    
    Summary: Lyrion Music Server (formerly Logitech Media Server, and
    often abbreviated as "LMS" ) is open-source software which can control
    and serve (stream) music to a wide range of physical and virtual audio
    players called Squeezeboxes. Lyrion Music Server can stream your local
    music collection, internet radio stations, and content from many streaming
    services (with and without subscriptions).
    
    Desc: Lyrion Music Server suffers from an unauthenticated reflected cross-site
    scripting vulnerability through 'server.log' endpoint abusing the 'search' GET
    parameter. Input is not properly sanitized before being returned to the user,
    allowing the execution of arbitrary HTML/JS code in a user's browser session
    in the context of the affected site.
    
    Tested on: Windows 10 (64-bit) - EN
               Lyrion Music Server (9.2.0 - 1779973211)
               Perl/5.32.1
               SQLite
    
    
    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                @zeroscience
    
    
    Advisory ID: ZSL-2026-5988
    Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-5988
    CVE ID: CVE-2026-50230
    CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-50230
    
    
    27.05.2026
    
    --
    
    
    http://localhost:9000/server.log?search="><script>confirm(251)</script>