Description
LemonLDAP::NG是LemonLDAP::NG开源的一套Web单点登录和访问管理软件。 LemonLDAP::NG 2.16.7之前版本和2.17版本至2.21.3之前版本存在操作系统命令注入漏洞，该漏洞源于Safe jail未在规则评估期间本地化，可能导致OS命令注入攻击。
LemonLDAP::NG 操作系统命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-59518
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-59518
https://www.nsfocus.net/vulndb/129452
https://security.snyk.io/vuln/SNYK-DEBIAN11-LEMONLDAPNG-12869223
https://access.redhat.com/security/cve/cve-2025-59518
https://app.opencve.io/cve/CVE-2025-59518
https://www.ameeba.com/blog/cve-2025-59518-os-command-injection-vulnerability-in-lemonldap-ng/
https://cve.imfht.com/detail/CVE-2025-59518
https://www.xtcaq.com/nd.jsp?id=9839
https://osv.dev/vulnerability/UBUNTU-CVE-2025-59518