PT-2026-25966 · Unknown · Ldap Account Manager

Jonaslejon · Published 2026-03-17 · Updated 2026-03-19 · CVE-2026-27895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 9.5

Description LDAP Account Manager (LAM) is a web frontend used for managing entries in an LDAP directory, such as users, groups, and DHCP settings. Before version 9.5, the PDF export component does not properly validate file extensions during file uploads, allowing any file type, including .php files, to be uploaded. This can lead to remote code execution as the web server user. The vulnerable component allows an attacker to upload malicious files, potentially compromising the system.

Recommendations Versions prior to 9.5 should be upgraded to version 9.5 or later. As a workaround, make the /var/lib/ldap-account-manager/config directory read-only for the web server user.

Exploit

Fix

RCE

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-27895

GHSA-88HF-2CJM-M9G8

GHSA-W7XQ-VJR3-P9CF

Affected Products

Ldap Account Manager

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27895.json · Exploit
• https://github.com/LDAPAccountManager/lam/releases/tag/9.5 · Patch
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27895 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27895 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27895 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27895 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27895 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27895 · Vendor Advisory
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf · Note
• https://twitter.com/CVEnew/status/2034136448245342547 · Twitter Post
• https://twitter.com/CVEarity/status/2034545554638995891 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034188801338143223 · Twitter Post