CVE-2026-27894: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-27894 is an authenticated Local File Inclusion (LFI) vulnerability in the PDF export functionality of LDAP Account Manager (LAM), a web frontend for managing LDAP directory entries. It affects all LAM versions up to and including 9.4, and was disclosed on March 17, 2026 by researcher jonaslejon. When chained with a related file upload bypass vulnerability (GHSA-88hf-2cjm-m9g8 / CVE-2026-27895), it enables full remote code execution as the web server user. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is improper control of filename input in PHP include/require statements within the PDF export component (CWE-98). The PDF export feature fails to adequately restrict user-supplied input used to reference local PHP files, allowing an authenticated attacker to specify arbitrary local PHP files for inclusion and execution. Exploitation is further enabled by a companion vulnerability (GHSA-88hf-2cjm-m9g8), where an incorrect regular expression in the same PDF export component permits uploading files of any type — including .php files — to the LAM configuration directory (/var/lib/ldap-account-manager/config). An attacker first uploads a malicious PHP file via the file upload flaw, then triggers its execution via the LFI, achieving remote code execution as the web server user. Valid LAM credentials are required as a precondition (GitHub Advisory, Upload Flaw Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary PHP code on the server as the web server user, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive LDAP directory data (including user credentials and group memberships), modify or delete directory entries, and potentially pivot to other infrastructure components connected to the LDAP backend. When the two vulnerabilities are chained, the attack escalates from a file inclusion to full remote code execution, enabling persistent access, web shell deployment, and lateral movement (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055%, reflecting low current exploitation probability. Exploitation requires valid LAM credentials, which limits the attack surface to authenticated users; however, the chained attack with CVE-2026-27895 significantly increases the severity for any deployment where user login is permitted (GitHub Advisory).

1. Authenticate to LAM: Obtain valid LAM credentials (any user with access to the admin UI) and log in to the LAM web interface.
2. Upload malicious PHP file: Exploit CVE-2026-27895 (GHSA-88hf-2cjm-m9g8) by uploading a PHP web shell (e.g., shell.php) through the PDF export component's file upload functionality. The flawed regex validation fails to block .php extensions, allowing the file to be written to /var/lib/ldap-account-manager/config/.
3. Trigger LFI via PDF export: Use the PDF export feature to specify the path to the uploaded PHP file as the included resource. The application's insufficient input validation allows the attacker-controlled filename to be passed to a PHP include or require statement.
4. Achieve code execution: The included PHP file is executed by the web server, running attacker-supplied commands as the web server user (e.g., www-data). This can be used to spawn a reverse shell, exfiltrate LDAP data, or establish persistence.
5. Post-exploitation: Use the web shell or reverse shell to enumerate the LDAP directory, harvest credentials, modify directory entries, or pivot to connected systems (GitHub Advisory, Upload Flaw Advisory).

• File System: Unexpected .php files in /var/lib/ldap-account-manager/config/ or its subdirectories, particularly files with names inconsistent with legitimate PDF profile names; newly created or modified files in the LAM configuration directory owned by the web server user.
• Logs: Web server access logs (e.g., Apache/Nginx) showing POST requests to LAM's PDF export or file upload endpoints followed by GET requests to the same directory for .php files; PHP error logs referencing unexpected include/require calls with user-controlled paths.
• Network: Outbound connections from the web server process to external IPs shortly after PDF export activity; unusual DNS lookups or reverse shell traffic originating from the web server.
• Process: Unexpected child processes spawned by the web server process (e.g., bash, sh, curl, wget, python) following LAM PDF export requests (GitHub Advisory).

Upgrade LDAP Account Manager to version 9.5, which fixes both CVE-2026-27894 and the companion vulnerability CVE-2026-27895 (LAM 9.5 Release). If immediate upgrading is not possible, apply the following workarounds: (1) make /var/lib/ldap-account-manager/config read-only for the web server user to prevent file uploads and configuration modification, and (2) delete all existing PDF profile files to disable PDF export functionality entirely. Additionally, restrict LAM access to trusted internal networks and enforce strong credential policies to reduce the risk from authenticated attackers (GitHub Advisory).

The vulnerability was reported by security researcher jonaslejon and disclosed by LAM maintainer gruberroland via GitHub Security Advisories on March 17, 2026. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. Tenable added detection support via Nessus plugin 302887. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking (GitHub Advisory, Tenable Plugin).