CVE-2025-59518

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-06-17
Weakness: CWE-78

Description

In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.

Affected products

lemonldap-ng LemonLDAP::NG: before 2.16.7; from 2.17.0 before 2.21.3 — fixed in 2.16.7, 2.21.3

How to fix

Upgrade to a fixed version: lemonldap-ng LemonLDAP::NG 2.16.7, 2.21.3. Check the vendor advisory for mitigations.

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/228d01945d48015f3f9ea8a8dc64d7e6a27750e9
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/3462

Get alerted when CVE-2025-59518 or the next vulnerability affects your stack