Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
LDAP Account Manager PDF Export Allows Remote Code Execution
CVE-2026-27895
Summary
A security flaw in the LDAP Account Manager's PDF export feature allows an attacker to upload malicious files, potentially taking control of the server. This can happen when using older versions of LDAP Account Manager. To fix this, update to version 9.5 or restrict the web-server user's access to the config directory.
Original title
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly v...
Original description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.
nvd CVSS3.1
4.3
Vulnerability type
CWE-185
Published: 18 Mar 2026 · Updated: 18 Mar 2026 · First seen: 18 Mar 2026