Remote Code Execution Vulnerability in LDAP Account Manager
CVE-2026-27895

4.3MEDIUM

Key Information:

Vendor: Ldapaccountmanager
Status: Lam
Vendor: CVE Published:; 17 March 2026

🔔 Create Ldapaccountmanager Vulnerability Alert

What is CVE-2026-27895?

A vulnerability in LDAP Account Manager allows unauthenticated attackers to upload arbitrary file types, including PHP scripts, due to insufficient validation of uploaded file extensions in the PDF export component. This flaw can lead to remote code execution under the web server user context. Users are advised to upgrade to version 9.5, which rectifies the issue. As an interim measure, setting /var/lib/ldap-account-manager/config to read-only for the web server user is recommended to mitigate potential risks.