CVE-2026-27895 LAM has incorrect regular expression in PDF export component that allows user to upload files of any type

Medium 4.3 Published 17 Mar 2026 Updated 18 Mar 2026

An attacker can upload arbitrary files, including PHP scripts, to the PDF export component, leading to remote code execution as the web server user.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-27895?

CVE-2026-27895 is a medium-severity vulnerability in LDAPAccountManager lam, published on 17 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.

Weakness: CWE-185

Which versions are affected by CVE-2026-27895?

It affects 1 product.

Products include Ldap-Account-Manager Ldap Account Manager.

How do I fix CVE-2026-27895?

Upgrade to a fixed version.

Is CVE-2026-27895 being exploited?

There is no known exploitation of CVE-2026-27895 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-27895, UBUNTU-CVE-2026-27895.