CVE-2026-27895: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-27895 is a file upload validation bypass vulnerability in the PDF export component of LDAP Account Manager (LAM), a web frontend for managing LDAP directory entries. The flaw stems from an incorrect regular expression (CWE-185) that fails to properly validate uploaded file extensions, allowing any file type — including .php files — to be uploaded by authenticated users. Affected versions span 8.5 through 9.4 (inclusive); version 9.5 resolves the issue. It carries a CVSS v3.1 base score of 8.8 (High) when chained with the related LFI vulnerability GHSA-w7xq-vjr3-p9cf, and was disclosed on March 17, 2026 (GitHub Advisory GHSA-88hf-2cjm-m9g8, LAM Release 9.5).

The root cause is an incorrect regular expression in LAM's PDF export component (CWE-185) that does not properly restrict uploaded file extensions, permitting arbitrary file types to be written to /var/lib/ldap-account-manager/config/ (GitHub Advisory GHSA-88hf-2cjm-m9g8). On its own, this vulnerability allows an authenticated low-privileged user (any user who can log into the LAM admin UI or use config import with the master configuration password) to upload malicious files such as PHP web shells. When chained with the companion Local File Inclusion vulnerability CVE-2026-27894 (GHSA-w7xq-vjr3-p9cf, CWE-98), which allows authenticated users to include local PHP files via the PDF export feature, an attacker can achieve full remote code execution as the web server user (GitHub Advisory GHSA-w7xq-vjr3-p9cf). The attack requires network access and low-level authentication but no user interaction, making it straightforward to exploit in environments where LAM is internet-facing.

Successful exploitation of CVE-2026-27895 alone allows an authenticated attacker to upload arbitrary files to the LAM configuration directory. When chained with CVE-2026-27894 (LFI), the attacker achieves remote code execution with the privileges of the web server user, resulting in full compromise of confidentiality, integrity, and availability of the LAM system and potentially the underlying LDAP directory it manages (GitHub Advisory GHSA-88hf-2cjm-m9g8, GitHub Advisory GHSA-w7xq-vjr3-p9cf). Since LAM manages LDAP directory entries such as users, groups, and DHCP settings, a compromised instance could expose or allow modification of sensitive organizational directory data and enable lateral movement within the network.

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability was reported by researcher jonaslejon and disclosed by the LAM maintainer on March 17, 2026 (GitHub Advisory GHSA-88hf-2cjm-m9g8). The EPSS score is approximately 0.062%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 302876 (Tenable).

1. Authenticate to LAM: Log in to the LAM admin UI using valid LDAP user credentials or the master configuration password for config import on an affected instance (versions 8.5–9.4).
2. Navigate to PDF export: Access the PDF export component within the LAM admin interface, which allows uploading custom PDF profile files.
3. Upload malicious PHP file: Craft a file upload request that bypasses the flawed regular expression validation by uploading a .php web shell file (e.g., shell.php) disguised or named to exploit the regex flaw. The file is written to /var/lib/ldap-account-manager/config/.
4. Trigger LFI via CVE-2026-27894: Use the companion LFI vulnerability (GHSA-w7xq-vjr3-p9cf) in the PDF export feature to include the uploaded PHP file by referencing it as a local file path in the PDF profile parameter.
5. Achieve RCE: The web server executes the included PHP file, granting the attacker remote code execution as the web server user, enabling data exfiltration, further lateral movement, or full system compromise (GitHub Advisory GHSA-88hf-2cjm-m9g8, GitHub Advisory GHSA-w7xq-vjr3-p9cf).

• File System: Unexpected non-PDF files (e.g., .php, .phtml, .phar) present in /var/lib/ldap-account-manager/config/; newly created PHP files with web shell content (e.g., system(), exec(), passthru() calls).
• Network: Unusual HTTP POST requests to LAM's PDF export/upload endpoints with non-standard file extensions in multipart form data; outbound connections from the web server process to external IPs following file upload activity.
• Logs: Web server access logs (Apache/Nginx) showing POST requests to LAM PDF profile upload endpoints followed by GET requests to .php files in the config directory; PHP error logs showing unexpected file inclusion events referencing /var/lib/ldap-account-manager/config/.
• Process: Unusual child processes spawned by the web server process (e.g., www-data spawning bash, curl, wget, or python) after access to the LAM PDF export feature.

Upgrade LDAP Account Manager to version 9.5 or later, which corrects the regular expression validation in the PDF export component and also fixes the companion LFI vulnerability CVE-2026-27894 (LAM Release 9.5). If immediate upgrading is not possible, make the directory /var/lib/ldap-account-manager/config/ read-only for the web server user to prevent file uploads; additionally, deleting existing PDF profile files will disable PDF exports but eliminates the LFI attack surface (GitHub Advisory GHSA-88hf-2cjm-m9g8). Restrict access to the LAM admin UI to trusted networks or VPN where possible to reduce exposure.

The vulnerability was credited to researcher jonaslejon and disclosed by LAM maintainer gruberroland on March 17, 2026, alongside the companion LFI advisory (GitHub Advisory GHSA-88hf-2cjm-m9g8). Red Hat has tracked the CVE in their security advisory database (Red Hat). No significant broader media coverage or notable community commentary beyond standard vulnerability aggregator coverage has been observed.