This vulnerability resides in the log rotation configuration endpoint of Liman. An authenticated administrator can send a request containing an ip_address parameter that is concatenated into a shell command without proper sanitization. By injecting a single quote, the attacker can terminate the argument and execute arbitrary shell commands, leading to full system compromise. The weakness directly maps to CWE‑20 (Improper Input Validation) and CWE‑78 (OS Command Injection).

Affected releases are all Liman core versions prior to 2.2.2‑1103. The product is open‑source server management software distributed by limanmys. Customers using any build older than the patched version are at risk; no specific platform or OS restriction is noted.

The CVSS base score of 9.1 indicates a high‑impact flaw with complete remote code execution capability for authorized users. The EPSS score is not publicly available, and the vulnerability has not yet been listed in the CISA KEV catalog. The flaw requires authentication as an administrator, but once authenticated an attacker can trivially craft an input to spawn arbitrary commands via the log rotation endpoint, with no additional exploitation steps. Because the issue involves unsanitized shell concatenation, automated scripts could target admin accounts to accelerate exploitation.