PT-2026-45437 · Unknown · Lightweight Music Server

Zeroscience · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-48559

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lightweight Music Server versions prior to 3.76.1

Description A stored cross-site scripting issue exists where attackers can execute arbitrary JavaScript by embedding malicious HTML in media file metadata tags, specifically GENRE, ARTIST, or ALBUM. The payload is saved during library scanning and executed automatically in the web interface because the tag content is rendered using the Wt::TextFormat::UnsafeXHTML format in the src/lms/ui/Utils.cpp file without proper sanitization.

Recommendations Update to a version later than 3.76.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48559

Affected Products

Lightweight Music Server

References · 6

• 🔥 https://zeroscience.mk/#/advisories/ZSL-2026-5987 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48559 · Security Note
• https://github.com/epoupon/lms/milestone/94 · Note
• https://github.com/epoupon/lms/issues/844 · Note
• https://twitter.com/VulmonFeeds/status/2061488236342501430 · Twitter Post
• https://vulncheck.com/advisories/lightweight-music-server-stored-xss-via-media-file-metadata-tags · Note