Lightweight Music Server (LMS) 3.76.0 Stored XSS via Metadata Tags (CVE-2026-48559)

Vulnerability Overview Vulnerability Name: Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS Vulnerability ID: ZSL-2026-5987 CVE ID: CVE-2026-48559 Publication Date: May 31, 2026 Discoverer: Gjoko Krstic Description: LMS (Lightweight Music Server) is a C++ project focused on low memory usage, featuring built-in user management and a recommendation engine. This vulnerability exists in how LMS stores metadata tags (such as GENRE, ARTIST, and ALBUM) for media files. These tags are stored verbatim in the files and rendered in the web interface without HTML encoding, leading to a Stored Cross-Site Scripting (Stored XSS) attack. An attacker can inject malicious tags into a victim's music library, saving the payload during the next library scan, which will then execute automatically when the user views the track information or plays the file. Impact Scope Affected Version: LMS 3.76.0 Test Environment: GNU/Linux (ARM64), nginx Remediation No specific remediation is currently provided on the page. Users are advised to monitor official updates or patches to address this security issue. POC Code References 1. https://www.cve.org/CVERecord?id=CVE-2026-48559 2. https://www.ainlock.com/advisories/lightweight-music-server-stored-xss-via-media-file-metadata-tags Timeline May 27, 2026: Vulnerability discovered May 31, 2026: New issue submitted on Github (#844) May 31, 2026: Public security advisory released Acknowledgments Vulnerability Discoverer: Gjoko Krstic Version History May 31, 2026: Initial release June 1, 2026: Added references [1] and [2]

Goal Reached Thanks to every supporter — we hit 100%!

Lightweight Music Server (LMS) 3.76.0 Stored XSS via Metadata Tags (CVE-2026-48559)