CVE-2022-31086

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.

• CWE-74
• CWE-434

• https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4Patch, Third Party Advisory
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982xThird Party Advisory
• https://www.debian.org/security/2022/dsa-5177Third Party Advisory
• https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4Patch, Third Party Advisory
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982xThird Party Advisory
• https://www.debian.org/security/2022/dsa-5177Third Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31080KubeEdge is an open source system for extending native conta…6.5
• CVE-2022-31081HTTP::Daemon is a simple http server class written in perl. …6.5
• CVE-2022-31082GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31083Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-31084LDAP Account Manager (LAM) is a webfrontend for managing ent…8.1
• CVE-2022-31085LDAP Account Manager (LAM) is a webfrontend for managing ent…6.1
• CVE-2022-31087LDAP Account Manager (LAM) is a webfrontend for managing ent…7.8
• CVE-2022-31088LDAP Account Manager (LAM) is a webfrontend for managing ent…5.3
• CVE-2022-31089Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-3109An issue was discovered in the FFmpeg package, where vp3_dec…7.5
• CVE-2022-31090Guzzle, an extensible PHP HTTP client. `Authorization` heade…7.7
• CVE-2022-31091Guzzle, an extensible PHP HTTP client. `Authorization` and `…7.7