All vulnerabilities
CVE-2026-105106

Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Koha Community Koha
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.61%Chance of exploitation activity in the next 30 days, higher than 75% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.11.00Also 24.11.20, 25.05.15 and 2 moreCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

Text from CVE List

Affected versions 5

  • Kohaaffected: all versions before 24.11.00CVE List
  • Kohaaffected: 24.11.00 before 24.11.20CVE List
  • Kohaaffected: 25.05.00 before 25.05.15CVE List
  • Kohaaffected: 25.11.00 before 25.11.09CVE List
  • Kohaaffected: 26.05.00 before 26.05.04CVE List

References 4