LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local …

LDAP Account Manager (LAM) versions prior to 9.5 contain a local file inclusion vulnerability in the PDF export functionality that allows authenticated users to include local PHP files and execute code. When combined with GHSA-88hf-2cjm-m9g8, this enables arbitrary code execution. The vulnerability requires user authentication to exploit. Version 9.5 addresses this issue, and workarounds include making the config directory read-only and removing PDF profile files.