LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 18, 2026 · NIST NVD

   Detected

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.

2. Jun 17, 2026 · NIST NVD

   Updated

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.

Affected

• cpe ldap-account-manager/ldap account managerversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27895

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27895

  LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com
• Not Applicable · github.com