Local File Inclusion in LDAP Account Manager Affects Users

CVE-2026-27894

What is CVE-2026-27894?

The LDAP Account Manager (LAM), used for managing entries within an LDAP directory, is susceptible to a local file inclusion vulnerability in its PDF export functionality. This flaw allows authenticated users to include local PHP files, enabling potential code execution on the server. Exploiting this vulnerability requires user login to LAM, and it coexists with another identified issue (GHSA-88hf-2cjm-m9g8), significantly increasing the risk of arbitrary code execution. It is vital for users to upgrade to version 9.5, which addresses this vulnerability. For those unable to upgrade, a temporary workaround involves setting the /var/lib/ldap-account-manager/config directory to read-only for the web-server user and removing PDF profile files to prevent exports.

References