Hi Salvatore,
the issue was fixed with 9.5 but there was a major issue why 9.5.1 was
released shortly afterwards. Both versions are ready to be uploaded:
https://www.ldap-account-manager.org/static/debian-packages/
Currently, I try to reach my last temporary sponsor to upload the packages.
Both versions would also work for trixie.
Best regards
Roland
Am 20.03.26 um 17:40 schrieb Salvatore Bonaccorso:
Source: ldap-account-manager
Version: 9.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for ldap-account-manager.
CVE-2026-27895[0]:
| LDAP Account Manager (LAM) is a webfrontend for managing entries
| (e.g. users, groups, DHCP settings) stored in an LDAP directory.
| Prior to version 9.5, the PDF export component does not correctly
| validate uploaded file extensions. This way any file type (including
| .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker
| can achieve remote code execution as the web server user. Version
| 9.5 fixes the issue. Although upgrading is recommended, a workaround
| would be to make /var/lib/ldap-account-manager/config read-only for
| the web-server user.
CVE-2026-27894[1]:
| LDAP Account Manager (LAM) is a webfrontend for managing entries
| (e.g. users, groups, DHCP settings) stored in an LDAP directory.
| Prior to version 9.5, a local file inclusion was detected in the PDF
| export that allows users to include local PHP files and this way
| execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to
| execute arbitrary code. Users need to login to LAM to exploit this
| vulnerability. Version 9.5 fixes the issue. Although upgrading is
| recommended, a workaround would be to make /var/lib/ldap-account-
| manager/config read-only for the web-server user and delete the PDF
| profile files (making PDF exports impossible).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-27895
https://www.cve.org/CVERecord?id=CVE-2026-27895
[1] https://security-tracker.debian.org/tracker/CVE-2026-27894
https://www.cve.org/CVERecord?id=CVE-2026-27894
[2]
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-w7xq-vjr3-p9cf
[3]
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-88hf-2cjm-m9g8
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
