External risk intelligence

Liman OS Command Injection via Log Rotation Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-57499

Liman is server management software which may be deployed as an internet-facing administrative interface. While such services are often restricted to internal networks, they are plausibly reachable from the internet in some deployments. The vulnerability requires administrator-level authentication, which limits the attack surface compared to unauthenticated public endpoints.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an OS command injection vulnerability in Liman, an open-source server management software, affecting versions prior to 2.2.2 - 1103. The flaw allows an authenticated administrator to execute arbitrary operating system commands on the server by exploiting a weakness in the log rotation configuration. This could potentially lead to unauthorized access and control over the affected server.

Attackers can run commands on servers.
Critical for confirmed Liman installations.
Verify Liman use and secure access.

Attack Path

How an attacker could exploit the issue

An attacker with administrator access to Liman server management software can exploit a flaw in the log rotation feature to run arbitrary commands on the server. This is possible because the `ip_address` setting for log rotation is not properly checked for malicious input, allowing an attacker to break out of the intended command and inject their own. If successful, this could lead to a complete compromise of the server.

Authenticated administrator access required.
Injecting commands via the `ip_address` setting.
Arbitrary OS command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An authenticated administrator could execute arbitrary operating system commands on the Liman server when supported by the advisory. This occurs because the `ip_address` parameter is directly embedded into a shell command without proper sanitization, allowing for shell escape via single-quote injection.

Server command execution.
Authenticated administrator injection.
Arbitrary OS command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects Liman server management software and requires authenticated administrator access. Infrastructure or platform teams managing Liman deployments should prioritize identifying all instances, assessing their exposure and business criticality, and confirming the accountable owner. Remediation planning should then follow based on the identified risk.

Owner: Infrastructure or Platform Teams.
Verify: Affected instances and reachability.
Act: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Liman and how is it used?

Liman is an open-source platform designed for centralized server management. Administrators use it to configure, monitor, and maintain server infrastructure through a unified interface. It simplifies routine system tasks, such as managing log rotations, by providing web-based tools that interface directly with the underlying operating system.

What does OS command injection mean for CVE-2026-57499?

This vulnerability involves a weakness known as Improper Neutralization of Special Elements used in an OS Command (CWE-78). It means the software does not properly filter user input before passing it to the server's command shell. By injecting specific characters, an authenticated user can break out of the intended function and force the system to execute unauthorized, arbitrary commands at the operating system level.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by accessing the log rotation configuration endpoint and providing malicious input within the `ip_address` parameter. The vulnerability specifically relies on single-quote injection to escape the intended command string. Note that this cannot be triggered by unauthenticated users or through unrelated application features; the attacker must already possess valid administrator credentials for the Liman software.

Is my Liman instance at risk if it is not on the internet?

Halo Surface Signal indicates that while this service may be deployed internally, it is often configured as an internet-facing administrative interface. Regardless of network placement, the primary requirement is administrator-level access. If your instance is reachable from the internet, it is at higher risk of unauthorized exploitation if credentials are compromised, but internal instances remain vulnerable to malicious actors or compromised accounts within your network.

What should I do if I am running Liman?

First, verify if your current version is older than 2.2.2 - 1103. If you are using an affected version, upgrade to 2.2.2 - 1103 or newer immediately to apply the patch. While planning the upgrade, ensure that access to the administrative management interface is restricted to authorized personnel only, utilizing network-level controls to limit reachability where possible.

References

github.com/limanmys/core/security/advisories/GHSA-3jrp-54r2-9g63

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.