Hi,

The following vulnerabilities were published for ldap-account-manager.

CVE-2026-27895[0]:
| LDAP Account Manager (LAM) is a webfrontend for managing entries
| (e.g. users, groups, DHCP settings) stored in an LDAP directory.
| Prior to version 9.5, the PDF export component does not correctly
| validate uploaded file extensions. This way any file type (including
| .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker
| can achieve remote code execution as the web server user. Version
| 9.5 fixes the issue. Although upgrading is recommended, a workaround
| would be to make /var/lib/ldap-account-manager/config read-only for
| the web-server user.


CVE-2026-27894[1]:
| LDAP Account Manager (LAM) is a webfrontend for managing entries
| (e.g. users, groups, DHCP settings) stored in an LDAP directory.
| Prior to version 9.5, a local file inclusion was detected in the PDF
| export that allows users to include local PHP files and this way
| execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to
| execute arbitrary code. Users need to login to LAM to exploit this
| vulnerability. Version 9.5 fixes the issue. Although upgrading is
| recommended, a workaround would be to make /var/lib/ldap-account-
| manager/config read-only for the web-server user and delete the PDF
| profile files (making PDF exports impossible).


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-27895
https://www.cve.org/CVERecord?id=CVE-2026-27895
[1] https://security-tracker.debian.org/tracker/CVE-2026-27894
https://www.cve.org/CVERecord?id=CVE-2026-27894
[2] https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf
[3] https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi Salvatore,

the issue was fixed with 9.5 but there was a major issue why 9.5.1 was
released shortly afterwards. Both versions are ready to be uploaded:

https://www.ldap-account-manager.org/static/debian-packages/

Currently, I try to reach my last temporary sponsor to upload the packages.

Both versions would also work for trixie.


Best regards
Roland



Am 20.03.26 um 17:40 schrieb Salvatore Bonaccorso: