CVE-2026-105106
Description
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
How to fix
- Koha Community Koha24.11.00, 24.11.20, 25.05.15, 25.11.09, 26.05.04 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Koha Community Koha | v < 24.11.00, 24.11.00 ≤ v < 24.11.20, 25.05.00 ≤ v < 25.05.15, 25.11.00 ≤ v < 25.11.09, 26.05.00 ≤ v < 26.05.04 | 24.11.00, 24.11.20, 25.05.15, 25.11.09, 26.05.04 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.