Vulnerability in Ldap-Account-Manager Ldap Account Manager
CVE-2026-27895
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.
EPSS: 0.004 (34.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Ldap-account-manager Ldap_account_manager
- Ldapaccountmanager Lam — versions < 9.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Not Applicable)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-27895?
- CVE-2026-27895 is a medium-severity vulnerability in Ldap-Account-Manager Ldap Account Manager, classified under Incorrect Regular Expression. CVSS score: 4.3/10. Published 2026-03-18.
- How severe is CVE-2026-27895?
- Medium severity. CVSS v3 base score is 4.3 out of 10.