CVE-2026-105106

Deferred Deferred - Pending Action

OS Command Injection in Koha Task Scheduler

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: TuranSec

Description

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105106

EUVD

EUVD-2026-100897

Affected Vendors & Products

Vendor	Product	Version / Range
Koha	Community	Koha 0
Koha	Community	Koha 24.11.00
Koha	Community	Koha 25.05.00
Koha	Community	Koha 25.11.00
Koha	Community	Koha 26.05.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validation. The Schedule::At::remove function substitutes the job ID into an atrm command without proper escaping and executes it via a system() call, allowing shell metacharacters to inject arbitrary commands.

Detection Guidance

Check Koha versions against patched releases (24.11.20, 25.05.15, 25.11.09, 26.05.04, or 26.11 dev branch). Review system logs for suspicious scheduler.pl requests with shell metacharacters in jobid parameters. Inspect atrm command executions in system logs for unquoted job IDs.

Impact Analysis

An authenticated staff user with the tools => schedule_tasks permission can execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in the jobid parameter. This could lead to full system compromise, data theft, or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosures, or integrity violations, potentially leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade Koha to a patched version immediately. Temporarily restrict access to the tools/scheduler.pl endpoint for non-admin users. Monitor system logs for unauthorized command executions. Disable the Task Scheduler feature if not required until patched.

Hi! I’m here to help you understand CVE-2026-105106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70