CVE-2026-27894

High

Published: 18 March 2026

Published

18 March 2026

Modified

23 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 22.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27894 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Ldap-Account-Manager Ldap Account Manager. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the LFI vulnerability by requiring timely remediation through patching to LAM version 9.5 or later.

SI-10 Information Input Validation good match

prevent

Prevents LFI exploitation in the PDF export by validating and sanitizing user-supplied file paths to block arbitrary local file inclusion.

CM-7 Least Functionality partial match

prevent

Eliminates the attack vector by restricting or prohibiting the PDF export functionality, aligning with the recommended workaround.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

LFI vulnerability in public-facing web app (LAM) directly enables T1190 for initial RCE; PHP file inclusion facilitates web shell deployment/execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local…

PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).

Deeper analysisAI

CVE-2026-27894 is a local file inclusion (LFI) vulnerability, classified under CWE-98, affecting LDAP Account Manager (LAM) versions prior to 9.5. LAM is a web-based frontend for managing LDAP directory entries, such as users, groups, and DHCP settings. The flaw resides in the PDF export functionality, which permits authenticated users to include and execute arbitrary local PHP files.

An attacker with valid login credentials to LAM (low privileges required) can exploit this over the network with low complexity and no user interaction, as indicated by the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). By manipulating the PDF export process, they can include sensitive local PHP files for code execution. When combined with the related vulnerability GHSA-88hf-2cjm-m9g8, this escalates to full arbitrary code execution on the server.

LAM version 9.5 resolves the issue, and upgrading is the recommended mitigation. As a workaround, administrators can render the /var/lib/ldap-account-manager/config directory read-only for the web server user and delete the PDF profile files, though this disables PDF export functionality. Additional details are available in the LAM release notes and security advisories on GitHub.