← Back

CVE-2026-27894

nvd nist
Published: Mar 18, 2026Modified: Mar 23, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security-advisories@github.com (Secondary)

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

Affected (1)

Ldap Account Manager
1 product
Ldap Account Manager
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ldap Account Manager
Before 9.5

Related CWEs

CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Not Applicable
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.