CVE-2026-27894
Received Received - Intake
Local File Inclusion in LDAP Account Manager Enables Code Execution

Publication date: 2026-03-18

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27894
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ldap-account-manager ldap_account_manager to 9.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in LDAP Account Manager (LAM) versions prior to 9.5, specifically in the PDF export feature. It allows a local file inclusion attack where users can include local PHP files, leading to code execution. To exploit this, a user must be logged into LAM. This vulnerability can be combined with another vulnerability (GHSA-88hf-2cjm-m9g8) to execute arbitrary code on the system.

Impact Analysis

This vulnerability can lead to the execution of arbitrary code on the server running LDAP Account Manager. An attacker who is able to log in can exploit the local file inclusion in the PDF export to run malicious PHP code, potentially compromising the confidentiality, integrity, and availability of the system and its data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability immediately, it is recommended to upgrade LDAP Account Manager to version 9.5 or later, where the issue is fixed.

If upgrading is not possible right away, a workaround includes making the /var/lib/ldap-account-manager/config directory read-only for the web-server user and deleting the PDF profile files to prevent PDF exports.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart