CVE-2026-19780
Received Received - Intake

Code Injection in Koha Library Software

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Zero Day Initiative

Description
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-19780
EUVD
EUVD-2026-78820

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koha koha *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a remote code execution vulnerability in Koha, an open-source library system. It allows authenticated remote attackers to execute arbitrary code by exploiting improper validation of user input passed to the eval function in the web service on TCP port 8081. Successful exploitation grants attacker privileges in the context of the service account.

Detection Guidance

To detect this vulnerability, check if Koha is running on TCP port 8081. Use commands like 'netstat -tulnp | grep 8081' or 'ss -tulnp | grep 8081' on Linux systems. Verify the Koha version against affected releases listed in updates 26.11.00, 26.05.02, 25.11.07, 25.05.13, and 24.11.18.

Impact Analysis

An attacker could gain control over the Koha server, steal sensitive data, modify or delete records, or disrupt library services. Since the service account context is compromised, attackers may escalate privileges further depending on system configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and mandatory breach notifications if exploited.

Mitigation Strategies

Immediately update Koha to a patched version (26.11.00, 26.05.02, 25.11.07, 25.05.13, or 24.11.18). If updating is not possible, restrict access to port 8081 via firewall rules and ensure authentication is enforced for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart