Vulnerability · Published Mar 17, 2026 · Assigned by GitHub_M
CVE-2026-27895LAM has incorrect regular expression in PDF export component that allows user to upload files of any type
Medium 4.3
In plain English
A medium-severity security flaw in lam from LDAPAccountManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | ldap-account-manager | no fix listed | DEBIAN-CVE-2026-27895 |
| Debian:14 | ldap-account-manager | 9.5.1-1 | DEBIAN-CVE-2026-27895 |
| Ubuntu:22.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-27895 |
| Ubuntu:24.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-27895 |
| Ubuntu:25.10 | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-27895 |
| Ubuntu:26.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-27895 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LDAPAccountManager | lam | < 9.5 |
Weakness: CWE-185 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N