Liman EUVD-2026-67136

Exploitation requires an authenticated account with administrator privileges on the Liman web interface (CVSS PR:H) and network access to the log rotation configuration endpoint; no user interaction is needed. The specific trigger is supplying the ip_address parameter with a single-quote character to escape the quoted shell context in the command the endpoint constructs. Limiting factors: the administrator-role requirement means this is not exploitable by anonymous or low-privileged users and is effectively a post-authentication / insider-or-credential-theft scenario rather than remote unauthenticated RCE; exposure is further limited when the admin panel is not reachable from untrusted networks.

The signals are moderately aligned but not uniformly severe. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network reachability, low complexity, and full confidentiality/integrity/availability impact with a scope change to the underlying OS - but it is materially gated by PR:H, meaning the attacker must already hold administrator credentials on Liman. In practice an authenticated Liman admin already wields extensive control over managed servers, so this bug primarily converts application-level admin into direct OS shell on the Liman host itself (privilege/scope escalation rather than initial access). There is no EPSS value, no KEV listing, and no evidence of a public POC in the provided data, so real-world exploitation pressure appears low and would most likely be targeted or insider/post-compromise rather than opportunistic mass exploitation. Net: a genuinely high-impact flaw worth patching promptly, but the high-privilege precondition keeps realistic risk below what the 9.1 headline suggests for internet-facing default deployments.

An authenticated Liman administrator (or an attacker who has phished/reused valid admin credentials) submits a crafted log rotation configuration in which the ip_address field is set to a value like '; <command>; ', breaking out of the single-quoted shell context. The injected command executes with the privileges of the Liman service account on the host, giving the attacker an OS-level foothold on the server-management platform. No user interaction and low attack complexity are required beyond holding admin access.