Ldap Account Manager CVE-2026-27894

Authenticated login to LDAP Account Manager versions prior to 9.5 required. Attacker must be a valid LAM user. Exploits PDF export functionality with local file inclusion to execute arbitrary PHP code. No victim interaction needed beyond authentication.

This represents a high real-world risk despite requiring authentication (PR:L). The CVSS score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-exploitable attacks with low complexity that require only low-privileged credentials and no user interaction, achieving complete system compromise. The tracking across 7 Ubuntu releases and 4 Debian releases with medium priority designation suggests widespread deployment in production environments. The existence of multiple related GitHub security advisories (GHSA-w7xq-vjr3-p9cf and GHSA-88hf-2cjm-m9g8) and explicit documentation of the exploit chain significantly lowers the barrier to exploitation. The vulnerability's presence in a privileged identity management system makes it particularly attractive to attackers seeking lateral movement and privilege escalation in Active Directory or LDAP environments. Given that LAM is specifically designed for administrative access to directory services, compromised instances provide direct access to credential stores and authentication infrastructure. While no KEV listing is noted, the combination of authentication bypass potential, code execution capability, and targeting of identity infrastructure makes this a genuine priority for organizations running LAM.

An attacker with low-privileged credentials to the LAM web interface (such as a compromised help desk account or a user with limited LDAP read permissions) authenticates to the application and navigates to the PDF export functionality. The attacker crafts a malicious PDF profile configuration that includes path traversal sequences pointing to a previously uploaded PHP webshell or crafted log file containing PHP code, leveraging the chained vulnerability GHSA-88hf-2cjm-m9g8 to place the malicious file. When the PDF export is triggered, the vulnerable include mechanism processes the attacker's file path, executing the embedded PHP code with web server privileges and granting the attacker remote code execution capabilities to compromise the LDAP management server, extract directory credentials, and pivot to connected systems.