CVE-2026-57499

Liman, an open source server management application, contains an OS command injection flaw (CWE-78) in its log rotation configuration endpoint in all versions prior to 2.2.2-1103. The `ip_address` parameter supplied to that endpoint is embedded directly into a shell command without sanitization, and an authenticated administrator can inject single quotes to break out of the command string and execute arbitrary operating system commands. Successful exploitation yields arbitrary command execution on the underlying Liman server with high confidentiality, integrity, and availability impact; the CVSS scope-change (S:C) indicates the impact escapes the web application to the host. Only deployments running affected versions are exposed, and the attack requires valid administrator credentials, so attackers would need to compromise or impersonate an admin account. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates roughly a 1% chance of exploitation in the next 30 days, so exploitation is not currently confirmed.

What to do: Upgrade Liman to version 2.2.2-1103 or later, which fixes the injection in the log rotation configuration endpoint. Until upgraded, restrict which accounts hold administrator rights in the panel and limit the panel's network exposure, since exploitation requires admin authentication. Review Liman servers for unexpected processes or shell commands originating from the panel to check whether the flaw has been abused.