Remote Command Execution Vulnerability in Koha Library Management System
CVE-2025-30076

7.7HIGH

Key Information:

Vendor

Koha

Status
Koha
Vendor
CVE Published:
16 March 2025

What is CVE-2025-30076?

The Koha Library Management System is affected by a vulnerability that allows administrators to execute arbitrary commands through the manipulation of shell metacharacters in the tools/scheduler.pl report parameter. This issue can lead to serious security breaches if exploited, as it provides an attacker with the capability to run unauthorized commands on the server, potentially compromising the integrity and confidentiality of the system. To secure your installation, it is crucial to update to the latest version of Koha that addresses this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Koha 0 < 22.11.24

Koha 23 < 23.11.12

Koha 24 < 24.05.07

References

https://github.com/gl0wyy/koha-task-scheduler-rce
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.