CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).
Засегнати продукти
- LDAPAccountManager lam: < 9.5
Вид слабост
История
- 17 март 2026 Публикувано
Други уязвимости в LDAPAccountManager lam
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-27894
- https://nvd.nist.gov/vuln/detail/CVE-2026-27894
- https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf
- https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8
- https://github.com/LDAPAccountManager/lam/releases/tag/9.5