Read the docs
TI-2025-37054 Aliases CVE-2025-59518GHSA-fxqv-qm7m-363x

OS command injection in lemonldap-ng LemonLDAP::NG

Priority LOW 39CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01146 66th percentileScored 2026-11-07
Fix Fixed LemonLDAP::NG (lemonldap-ng): 2.16.7, 2.21.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lemonldap-ngLemonLDAP::NGbefore 2.16.7; 2.17.0 to before 2.21.32.16.7, 2.21.3Patch availableCNA
  • LemonLDAP::NG Vendorlemonldap-ng Affected before 2.16.7; 2.17.0 to before 2.21.3 Fixed in 2.16.7, 2.21.3 Patch available CNA

Remediation

  • Fix · CNA LemonLDAP::NG (lemonldap-ng) Fixed in 2.16.7, 2.21.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59518
  2. 2026-10-03 Alias added: GHSA-fxqv-qm7m-363x

References

Other 2

  • TI-2023-13366 An issue was discovered in LemonLDAP::NG before 2.16.1. CVSS 3.1CRITICAL 9.8
  • TI-2024-32628 A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote… CVSS 3.1MEDIUM 6.1
  • TI-2022-17335 In LemonLDAP::NG before 2.0.15. CVSS 3.1MEDIUM 5.9
  • TI-2023-23963 A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before… CVSS 3.1MEDIUM 4.3
  • TI-2019-14263 In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server… CVSS 3.1CRITICAL 9.8
  • TI-2019-09012 LemonLDAP::NG -2.0.3 has Incorrect Access Control. CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences