CVE-2026-27894 Details
Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).
A local file inclusion vulnerability has been identified in the PDF export feature of LDAP Account Manager (LAM) versions prior to 9.5. This vulnerability allows authenticated users to include local PHP files, which can lead to code execution. The issue arises from improper validation of uploaded file extensions, enabling the upload of any file type, including PHP files. When combined with another vulnerability (GHSA-88hf-2cjm-m9g8), this could result in remote code execution as the web server user.
Users are advised to upgrade to LAM version 9.5, which addresses this vulnerability. Instructions for downloading the latest version are available on the LDAP Account Manager GitHub Releases page. As an interim measure, the directory containing LAM's configuration files can be made read-only for the web server user, and the PDF profile files can be deleted to prevent PDF exports.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ldap-account-manager ldap account manager | < 9.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |