CVE-2026-105106
CVE-2026-105106 · Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
CVSS 8.8 · High · EPSS 1.6% · Fix available
- Published
- Updated
Affected products and versions
koha
- Versions
- ≥ 0, < 24.11.00: Affected (custom)
- ≥ 24.11.00, < 24.11.20: Affected (custom)
- ≥ 25.05.00, < 25.05.15: Affected (custom)
- ≥ 25.11.00, < 25.11.09: Affected (custom)
- ≥ 26.05.00, < 26.05.04: Affected (custom)
Update to 24.11.00; Update to 24.11.20; Update to 25.05.15; Update to 25.11.09; Update to 26.05.04