CVE-2026-57499: Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Limanto a version that resolves this vulnerability.Fixed in 2.2.2 - 1103
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated as a Liman administrator. The vulnerable log rotation configuration endpoint is exposed to that administrator role, and exploitation does not require user interaction.
What input is used to inject commands?
The log rotation configuration endpoint embeds the ip_address parameter directly into a shell command without sanitization. An authenticated administrator can escape the intended shell quoting using a single quote and execute arbitrary operating system commands on the Liman server.
Which Liman versions are affected?
Liman versions prior to 2.2.2 - 1103 are affected. The issue is fixed in version 2.2.2 - 1103.