Source: ldap-account-manager Version: 9.0-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for ldap-account-manager. CVE-2026-27895[0]: | LDAP Account Manager (LAM) is a webfrontend for managing entries | (e.g. users, groups, DHCP settings) stored in an LDAP directory. | Prior to version 9.5, the PDF export component does not correctly | validate uploaded file extensions. This way any file type (including | .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker | can achieve remote code execution as the web server user. Version | 9.5 fixes the issue. Although upgrading is recommended, a workaround | would be to make /var/lib/ldap-account-manager/config read-only for | the web-server user. CVE-2026-27894[1]: | LDAP Account Manager (LAM) is a webfrontend for managing entries | (e.g. users, groups, DHCP settings) stored in an LDAP directory. | Prior to version 9.5, a local file inclusion was detected in the PDF | export that allows users to include local PHP files and this way | execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to | execute arbitrary code. Users need to login to LAM to exploit this | vulnerability. Version 9.5 fixes the issue. Although upgrading is | recommended, a workaround would be to make /var/lib/ldap-account- | manager/config read-only for the web-server user and delete the PDF | profile files (making PDF exports impossible). If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-27895 https://www.cve.org/CVERecord?id=CVE-2026-27895 [1] https://security-tracker.debian.org/tracker/CVE-2026-27894 https://www.cve.org/CVERecord?id=CVE-2026-27894 [2] https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf [3] https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
