CVE-2026-27895
Published: 18 March 2026
Summary
CVE-2026-27895 is a medium-severity Incorrect Regular Expression (CWE-185) vulnerability in Ldap-Account-Manager Ldap Account Manager. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the inadequate validation of uploaded file extensions in the PDF export component by requiring comprehensive input validation to prevent arbitrary file uploads.
Addresses the core flaw by requiring timely remediation through upgrading to LAM version 9.5, eliminating the vulnerability.
Prevents exploitation by restricting file types and characteristics allowed in uploads via the PDF export feature.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload (PHP) in public-facing web app directly enables initial access via exploitation (T1190), ingress of malicious files (T1105), and web shell deployment for RCE (T1505.003).
NVD Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type…
more
(including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.
Deeper analysisAI
CVE-2026-27895 affects LDAP Account Manager (LAM), a web-based frontend for managing LDAP directory entries such as users, groups, and DHCP settings. In versions prior to 9.5, the PDF export component fails to properly validate uploaded file extensions, enabling the upload of arbitrary file types, including PHP files. This vulnerability, classified under CWE-185 (Incorrect Regular Expression) with a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), stems from inadequate input validation in the file upload process.
An attacker with low-privileged access (PR:L), such as an authenticated LAM user, can exploit this over the network with low complexity and no user interaction required. By uploading malicious files disguised through the PDF export feature, they can achieve file upload integrity violations. When combined with GHSA-w7xq-vjr3-p9cf, this leads to remote code execution as the web server user.
LAM version 9.5 resolves the issue, and upgrading is the recommended mitigation. As a workaround, administrators can make the /var/lib/ldap-account-manager/config directory read-only for the web server user. Relevant advisories and the patch release are detailed in GitHub security advisories GHSA-88hf-2cjm-m9g8, GHSA-w7xq-vjr3-p9cf, and the LAM 9.5 release notes.
Details
- CWE(s)