CVE-2026-57499

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.

• CWE-20
• CWE-78

• https://github.com/limanmys/core/security/advisories/GHSA-3jrp-54r2-9g63
• https://github.com/limanmys/core/security/advisories/GHSA-3jrp-54r2-9g63

Published

Aug 27, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57485Stirling-PDF is a locally hosted web application that facili…8.5
• CVE-2026-5749Inadequate access control in the registration process in Ful…8.7
• CVE-2026-57494AgenticMail gives AI agents real email addresses and phone n…7.1
• CVE-2026-57495AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-57497webtransport-go is an implementation of the WebTransport pro…5.3
• CVE-2026-57498Coolify is an open-source and self-hostable tool for managin…9.6
• CVE-2026-5750An insecure direct object reference (IDOR) vulnerability in …7.6
• CVE-2026-57501Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glan…0
• CVE-2026-5751justhtml versions 1.13.0 and earlier contain a parser-differ…6.1
• CVE-2026-57510SuperPlane before 0.27.0 contains a broken object-level auth…8.8
• CVE-2026-57511SuperPlane before 0.30.0 contains an SMTP header injection v…6.3
• CVE-2026-57516Ray prior to 2.56.0 contains an unsafe deserialization vulne…8.8