CVE-2026-105106
CVE-2026-105106 · Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
CVSS 8.8 · Alta · EPSS 1,9% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
koha
- Versiones
- ≥ 0, < 24.11.00: Afectada (custom)
- ≥ 24.11.00, < 24.11.20: Afectada (custom)
- ≥ 25.05.00, < 25.05.15: Afectada (custom)
- ≥ 25.11.00, < 25.11.09: Afectada (custom)
- ≥ 26.05.00, < 26.05.04: Afectada (custom)
Actualiza a 24.11.20; Actualiza a 25.05.15; Actualiza a 25.11.09; Actualiza a 26.05.04