An authenticated remote code execution vulnerability in LDAP Account Manager (LAM) poses a critical risk to directory management infrastructure.

The application suffers from a local file inclusion (CWE-98) flaw within its PDF export functionality. An authenticated attacker can leverage this vulnerability to include local PHP files and achieve arbitrary code execution on the underlying server.

Successful exploitation allows an authenticated user to achieve full remote code execution on the host server. Given the CVSS score of 8.8, this vulnerability represents a high risk of total system compromise, potentially leading to unauthorized access to sensitive LDAP credentials, lateral movement within the network, and complete loss of directory management integrity.

Immediate Action: Update LDAP Account Manager to version 9.5 or later to resolve the underlying file inclusion vulnerability.

Proactive Monitoring: Review web access logs for unusual requests directed toward the PDF export module or attempts to access unexpected local system files.

Compensating Controls: If immediate patching is not feasible, make the configuration directory /var/lib/ldap-account-manager/config read-only for the web server user and delete all PDF profile files to prevent the exploitation vector.

Public Exploit Available: No (exploit_available: unknown)

The ability to execute arbitrary code via a local file inclusion flaw necessitates prompt attention despite the authentication requirement. Organizations should prioritize updating to version 9.5 immediately. In environments where immediate patching is delayed, applying the suggested file system permissions and removing PDF profiles serves as a critical stopgap to prevent potential compromise.