← Vulnerability feed

Vulnerability record · CVE-2026-27894 · published 18 March 2026

CVE-2026-27894: Ldap-account-manager ldap account manager php remote file inclusion vulnerability

Ldap Account Manager · Ldap Account Manager

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

8.8 CVSS 3.1 High EPSS 0.67% · top 50.1% CWE-98 · PHP remote file inclusion
8.8CVSS 3.1 base score
0.67%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/LDAPAccountManager/lam/releases/tag/9.5 Patch
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 Not Applicable
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf Vendor Advisory

Track CVE-2026-27894 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-27895Ldap-account-manager ldap account manager vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.…EPSS 0.77%8.8CVE-2022-31086Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 2.3%8.8CVE-2018-8764Debian linux cross-site request forgery vulnerabilityRoland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for …EPSS 1.3%8.1CVE-2022-31084Ldap-account-manager ldap account manager argument injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 2.5%7.8CVE-2022-31087Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 0.44%6.6CVE-2024-23333Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary pat…EPSS 18%6.1CVE-2022-31085Ldap-account-manager ldap account manager missing encryption vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 0.27%6.1CVE-2012-1114Ldap-account-manager ldap account manager cross-site scripting vulnerabilityA Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2026-27894), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.