The vulnerability resides in the PDF export component of LDAP Account Manager, where an incorrect regular‑expression check fails to validate uploaded file extensions. This oversight enables an attacker to upload arbitrary files, including executable PHP scripts, to the server. By doing so, the attacker can gain code execution privileges on the system as the user account under which the web server is running.

Organizations deploying LDAP Account Manager versions earlier than 9.5 are affected. The flaw applies to the web‑frontend component that handles PDF export uploads in those releases. Any installation of the LDAP Account Manager package on operating systems that run a web server will have the same exposure.

The CVSS score for this issue is 4.3, indicating a low severity rating, while the EPSS probability is below 1%, suggesting that the flaw is unlikely to be widely exploited at present. Nonetheless, the vulnerability permits remote code execution, which could lead to full system compromise if the web server operates with elevated privileges. No known exploits are listed in the CISA KEV catalog, and exploitation would likely require access to the web interface to upload a malicious file. Once uploaded, the script would execute with the web server’s user permissions.