Vulnerability record · CVE-2026-27895 · published 18 March 2026

CVE-2026-27895: Ldap-account-manager ldap account manager vulnerability

Ldap Account Manager · Ldap Account Manager

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.

8.8 CVSS 3.1 High EPSS 0.77% · top 46.1% CWE-185 · CWE-185

8.8CVSS 3.1 base score

0.77%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ldap Account Manager Ldap Account Manager

References

Link	Tags
https://github.com/LDAPAccountManager/lam/releases/tag/9.5	Patch
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8	Vendor Advisory
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf	Not Applicable

Track CVE-2026-27895 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-27894Ldap-account-manager ldap account manager php remote file inclusion vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.…EPSS 0.67%18 Mar 2026 8.8CVE-2022-31086Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 2.3%27 Jun 2022 8.8CVE-2018-8764Debian linux cross-site request forgery vulnerabilityRoland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for …EPSS 1.3%27 Mar 2018 8.1CVE-2022-31084Ldap-account-manager ldap account manager argument injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 2.5%27 Jun 2022 7.8CVE-2022-31087Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 0.44%27 Jun 2022 6.6CVE-2024-23333Ldap-account-manager ldap account manager injection vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary pat…EPSS 18%18 Mar 2024 6.1CVE-2022-31085Ldap-account-manager ldap account manager missing encryption vulnerabilityLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior t…EPSS 0.27%27 Jun 2022 6.1CVE-2012-1114Ldap-account-manager ldap account manager cross-site scripting vulnerabilityA Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_…EPSS 1.6%5 Dec 2019

Source: NIST National Vulnerability Database (record CVE-2026-27895), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.