LDAP Account Manager (LAM) is a web-based interface used to manage LDAP directory entries such as users, groups, and DHCP settings. In versions prior to 9.5, the PDF export functionality contains a vulnerability due to an incorrect regular expression used to validate uploaded file extensions. This flaw (CWE-185) allows an attacker with limited privileges (requiring some level of authentication) to upload files of any type, including potentially malicious PHP scripts. Because the uploaded files can be executed by the web server, this can lead to remote code execution (RCE) under the web server's user context. The vulnerability is tracked as CVE-2026-27895 with a CVSS 3.1 base score of 4.3 (medium severity), reflecting the need for authentication and the limited scope of impact (no confidentiality or availability impact directly). The vulnerability does not require user interaction beyond authentication and can be mitigated by upgrading to version 9.5 where the validation is corrected. Alternatively, restricting write permissions on the /var/lib/ldap-account-manager/config directory for the web server user can prevent malicious file uploads from being saved or executed. No public exploits have been reported yet, but the potential for RCE makes this a significant risk for organizations relying on LAM for LDAP management.

If exploited, this vulnerability allows an authenticated attacker to upload arbitrary files, including executable scripts, to the LAM server. This can lead to remote code execution with the privileges of the web server user, potentially allowing attackers to manipulate LDAP data, escalate privileges, or pivot within the network. While the confidentiality impact is minimal since the vulnerability does not directly expose data, the integrity of LDAP entries and the availability of the service could be compromised through malicious code execution. Organizations using LAM in critical infrastructure or identity management roles could face significant operational disruptions and security breaches. The medium CVSS score reflects the need for authentication and the limited scope of impact, but the risk remains notable due to the potential for lateral movement and further exploitation post-compromise.

1. Upgrade LDAP Account Manager to version 9.5 or later, where the file extension validation issue is fixed. 2. As an immediate workaround, change the permissions of /var/lib/ldap-account-manager/config to be read-only for the web server user to prevent unauthorized file uploads. 3. Implement strict access controls and monitoring on the LAM server, including limiting user accounts that can upload files. 4. Employ web application firewalls (WAFs) to detect and block suspicious file upload attempts targeting the PDF export functionality. 5. Regularly audit uploaded files and server directories for unauthorized or unexpected files. 6. Monitor logs for unusual activity related to file uploads and execution attempts. 7. Consider isolating the LAM server in a segmented network zone to limit potential lateral movement if compromised.