CVE catalog

CVE-2026-27895

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly vali

[CVE catalog]

Severity
Medium · CVSS 4.3
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianldap-account-managersid9.7-1fixed
Debianldap-account-managerforky9.7-1fixed
Debianldap-account-managertrixie9.0-1vulnerable
Debianldap-account-managerbookworm8.3-1not affected
Cpeldap-account-managerNot reportedNot reportedvulnerable
Ubuntuldap-account-manager16.044.9-1vulnerable
Ubuntuldap-account-manager16.045.1-1vulnerable
Ubuntuldap-account-manager16.045.2-1vulnerable
Ubuntuldap-account-manager16.045.2-1ubuntu1vulnerable
Ubuntuldap-account-manager18.045.7-1vulnerable
Ubuntuldap-account-manager18.046.1-1vulnerable
Ubuntuldap-account-manager18.046.2-1vulnerable
Ubuntuldap-account-manager20.046.7-1vulnerable
Ubuntuldap-account-manager22.047.5-1vulnerable
Ubuntuldap-account-manager22.047.7-1vulnerable
Ubuntuldap-account-manager24.048.3-1vulnerable
Ubuntuldap-account-manager24.048.5-1vulnerable
Ubuntuldap-account-manager25.109.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianldap-account-managersourcesid9.5.1-1not yet assignedNot reported[1131370]
Debianldap-account-managersourceforky9.5.1-1not yet assignedNot reported[1131370]
Debianldap-account-managersourcetrixie(unfixed)not yet assignedNot reported[1131370]
Debianldap-account-managersourcebookwormNot affectedunimportantNot reported[1131370]

[Debian bug #1131370]

Notes

[trixie] ldap-account-manager: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [ldap-account-manager]Affected
    Details (2)

    • 9.0-1 · all · trixie

      Affected

      nvd · ldap-account-manager · debian · 13

    • 9.0-1 · all · trixie

      Affected

      nvd · ldap-account-manager · debian · 13

  • [ldap-account-manager-lamdaemon]Affected

    Source package: [ldap-account-manager]

    Details (2)

    • 9.0-1 · all · trixie

      Affected

      nvd · ldap-account-manager · debian · 13

    • 9.0-1 · all · trixie

      Affected

      nvd · ldap-account-manager · debian · 13

[Debian 12 (Bookworm)]

  • [ldap-account-manager]Not affected
    Details (2)

    • 8.3-1 · all · bookworm

      Not affected

      nvd · ldap-account-manager · debian · bookworm

    • 8.3-1 · all · bookworm

      Not affected

      nvd · ldap-account-manager · debian · bookworm

  • [ldap-account-manager-lamdaemon]Not affected

    Source package: [ldap-account-manager]

    Details (2)

    • 8.3-1 · all · bookworm

      Not affected

      nvd · ldap-account-manager · debian · bookworm

    • 8.3-1 · all · bookworm

      Not affected

      nvd · ldap-account-manager · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]