https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27895.htmlhttps://patchthecve.com/cve/CVE-2026-27895.htmlWed, 17 Jun 2026 10:27:50 +0000MEDIUM 4.3: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With Ghttps://patchthecve.com/cve/CVE-2026-27894.htmlhttps://patchthecve.com/cve/CVE-2026-27894.htmlWed, 17 Jun 2026 10:27:50 +0000HIGH 8.8: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHhttps://patchthecve.com/cve/CVE-2024-23333.htmlhttps://patchthecve.com/cve/CVE-2024-23333.htmlWed, 17 Jun 2026 07:12:36 +0000HIGH 7.9: LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the