CVE-2026-57499

Deferred Deferred - Pending Action

OS Command Injection in Liman Server Management Software

Publication date: 2026-08-27

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-57499

EUVD

EUVD-2026-67136

Affected Vendors & Products

Vendor	Product	Version / Range
liman	liman	to 2.2.2-1103 (exc)
limanmys	core	to 2.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-57499 is an OS command injection vulnerability in Liman server management software versions prior to 2.2.2. It allows an authenticated administrator to execute arbitrary operating system commands on the server through the log rotation configuration endpoint. The vulnerability occurs because the ip_address parameter is directly embedded into a shell command without proper sanitization, enabling attackers to inject malicious commands via single-quote injection.

Detection Guidance

Check Liman server versions prior to 2.2.2-1103. Inspect logs for suspicious POST requests to /api/settings/advanced/log_rotation with malformed ip_address parameters. Look for command execution artifacts like files in /tmp or unexpected system commands.

Impact Analysis

This vulnerability allows an authenticated administrator to execute arbitrary commands on the Liman server. An attacker could gain full control over the server, potentially leading to data theft, system compromise, or disruption of services. The impact includes privilege escalation beyond intended admin capabilities and full server takeover if admin credentials are compromised.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR and HIPAA. It compromises confidentiality and integrity of sensitive data, potentially resulting in regulatory penalties, legal consequences, and reputational damage for organizations handling protected information.

Mitigation Strategies

Upgrade Liman to version 2.2.2-1103 or later immediately. If immediate upgrade is not possible, restrict access to the LogRotationController endpoint and review admin user permissions to limit exposure.

Hi! I’m here to help you understand CVE-2026-57499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70