CVE-2026-105106 Details
Description
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
A command injection vulnerability has been identified in Koha's Task Scheduler feature, specifically within the 'delete job' operation of the 'tools/scheduler.pl' handler. This vulnerability allows authenticated staff users with the 'tools => schedule_tasks' permission to execute arbitrary operating system commands. The issue arises because the 'jobid' parameter is passed to the 'C4::Scheduler::remove_at_job' function without proper validation. The 'remove_at_job' function then executes the command using a 'system()' call, which invokes the shell, allowing for the execution of commands as the Koha web/application user.
Users can update to Koha versions 24.11.20, 25.05.15, 25.11.09, or 26.05.04. Instructions for downloading Koha can be found on the Koha Community website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674 | CISA-ADP | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674 | TuranSec | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://download.koha-community.org/ | TuranSec | ProductVendor |
| https://www.cve.org/CVERecord?id=CVE-2024-28739 | TuranSec | Not Applicable |
| https://www.cve.org/CVERecord?id=CVE-2025-30076 | TuranSec | AdvisoryExploitIssue TrackingRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Koha | <= 22.11.24 (semver) <= 23 <= 23.11.12 (semver) <= 24 <= 24.05.07 (semver) <= 24.06 <= 24.11.02 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | TuranSec |