CVE-2026-48559

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

Lightweight Music Server (LMS) though 3.76.0 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by embedding malicious HTML in media file metadata tags such as GENRE, ARTIST, or ALBUM. Attackers can introduce a crafted media file into the victim's library, causing the payload to be saved during library scanning and executed automatically in the web interface due to tag content being rendered using Wt::TextFormat::UnsafeXHTML without sanitization in src/lms/ui/Utils.cpp.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-485605.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-485619.6Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized CVE-2026-485624.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-485637.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-485648.8Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.CVE-2026-485657.8Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.CVE-2026-485665.5Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-485679.8Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.CVE-2026-485687.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485695.5Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-48578.4IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow aut CVE-2026-485707.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.