← Advisories

Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS

High
Advisory ID
ZSL-2026-5987
Release Date
31 May 2026
Vendor
Affected Version
3.76.0
Tested On
GNU/Linux (ARM64), nginx
Summary

LMS (Lightweight Music Server): A specific C++ based project focused on a low memory footprint, featuring built-in user management and a recommendation engine.

Description

LMS stores media file metadata tags (such as GENRE, ARTIST, and ALBUM) exactly as written in the file and later renders them in its web interface without HTML-encoding, resulting in stored cross-site scripting. An attacker who gets a file with a malicious tag into the victim's library has their payload saved during the next library scan and executed automatically whenever a user views that track's information or plays the file in the web UI.

/src/lms/ui/Utils.cpp --------------------- 131: std::unique_ptr<Wt::WInteractWidget> createFilter(const Wt::WString& name, const Wt::WString& tooltip, std::string_view colorStyleClass, bool canDelete) 132: { 133: auto res{ std::make_unique<Wt::WText>(Wt::WString{ canDelete ? "<i class=\"fa fa-times-circle\"></i> " : "" } + name, Wt::TextFormat::UnsafeXHTML) }; 134: res->setStyleClass("Lms-badge-cluster badge me-1 " + std::string{ colorStyleClass }); 135: res->setInline(true); 136: return res; 137: }
Proof of Concept
Disclosure Timeline
27.05.2026Vulnerability discovered.
31.05.2026Opened a new ticket (#844) on Github.
31.05.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
31.05.2026Initial release
01.06.2026Added reference [1] and [2]
02.06.2026Added reference [3], [4], [5] and [6]