CVE-2026-27894

Katalog CVE

CVSS 8.8 · High EPSS 0,67%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada ldap-account-manager ldap account manager. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf advisory vendor
• https://github.com/LDAPAccountManager/lam/releases/tag/9.5 patch
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 not applicable