PT-2026-25966 · Unknown · Ldap Account Manager

Jonaslejon · Publicado 2026-03-17 · Atualizado 2026-03-19 · CVE-2026-27895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 9.5

Description LDAP Account Manager (LAM) is a web frontend used for managing entries in an LDAP directory, such as users, groups, and DHCP settings. Before version 9.5, the PDF export component does not properly validate file extensions during file uploads, allowing any file type, including .php files, to be uploaded. This can lead to remote code execution as the web server user. The vulnerable component allows an attacker to upload malicious files, potentially compromising the system.

Recommendations Versions prior to 9.5 should be upgraded to version 9.5 or later. As a workaround, make the /var/lib/ldap-account-manager/config directory read-only for the web server user.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-185

Identificadores relacionados

CVE-2026-27895

GHSA-88HF-2CJM-M9G8

GHSA-W7XQ-VJR3-P9CF

Produtos afetados

Ldap Account Manager

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27895.json · Exploit
• https://github.com/LDAPAccountManager/lam/releases/tag/9.5 · Correção
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 · Aviso do Fabricante
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf · Nota
• https://ubuntu.com/security/CVE-2026-27895 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136448245342547 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-27895 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2034545554638995891 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27895 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27895 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27895 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-27895 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27895 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034188801338143223 · Publicação no Twitter