What is the CVSS score of CVE-2026-27894?

CVE-2026-27894 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27894?

LDAP Account Manager installations below version 9.5 contain a high-severity vulnerability allowing authenticated users to execute arbitrary code through malicious PDF exports.. A patch is available.

How to fix or mitigate CVE-2026-27894?

Within 24 hours: Identify all LAM instances in production and document their versions; restrict LAM access to essential administrative personnel only; monitor for suspicious PDF export activity. Within 7 days: Upgrade LAM to version 9.5 or later on all affected systems, or implement compensating controls if upgrade is not immediately feasible. Within 30 days: Verify successful patching across all instances and validate that no unauthorized code execution has occurred through log analysis.

PHP CVE-2026-27894

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-18 security-advisories@github.com

PHP LFI RCE

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 18, 2026 - 00:30 vuln.today

CVE Published

Mar 18, 2026 - 00:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

AnalysisAI

LDAP Account Manager (LAM), a web-based interface for managing LDAP directory entries, contains a local file inclusion vulnerability in its PDF export functionality that allows authenticated users to include and execute arbitrary PHP files. When chained with GHSA-88hf-2cjm-m9g8, this vulnerability enables complete remote code execution on the affected server. The vulnerability affects all versions prior to 9.5 and requires low-privilege authentication (CVSS 8.8, PR:L), tracking across 7 Ubuntu and 4 Debian releases indicates significant deployment in enterprise LDAP environments.

Technical ContextAI

This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as local file inclusion. LDAP Account Manager is a PHP-based web application that provides a graphical interface for managing LDAP directories, typically used in enterprise environments for user account, group, and DHCP configuration management. The flaw exists in the PDF profile export mechanism where user-controlled input is insufficiently validated before being passed to PHP include or require statements. The vulnerability's severity is amplified by its chain-ability with GHSA-88hf-2cjm-m9g8, suggesting a multi-stage attack path where file write capabilities combined with file inclusion lead to arbitrary code execution. The affected component processes PDF configuration profiles stored in /var/lib/ldap-account-manager/config, where malicious PHP code can be injected and subsequently included during PDF generation.

RemediationAI

Upgrade LDAP Account Manager to version 9.5 or later immediately, as documented in the release notes at https://github.com/LDAPAccountManager/lam/releases/tag/9.5. Until patching is completed, implement the recommended workaround by making the /var/lib/ldap-account-manager/config directory read-only for the web server user (typically www-data or apache) using filesystem permissions, and delete all existing PDF profile files to prevent exploitation through the vulnerable code path, though this will disable PDF export functionality. Additionally, review web server access logs for suspicious file access patterns in the config directory, restrict LAM interface access to trusted networks using firewall rules or reverse proxy ACLs, enforce strong authentication for all LAM accounts, and audit existing user accounts for unauthorized privilege escalation. Given the chain-ability with GHSA-88hf-2cjm-m9g8, also review that advisory at https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 for additional mitigation steps.