OS Command Injection in Koha Task Scheduler by Koha Community

CVE-2026-105106

What is CVE-2026-105106?

Koha is susceptible to OS command injection through its Task Scheduler deletion process. The vulnerability arises when the tools/scheduler.pl handler processes the jobid request parameter for the op=cud-delete operation without proper input validation. This oversight allows an authenticated staff user with specific permissions to execute arbitrary operating system commands by injecting shell metacharacters into the job ID. The malformed input is directly integrated into an atrm command string and executed via a system() call, which invokes the shell, thus allowing potential exploitation of the system. Users are encouraged to update to the fixed versions to mitigate this risk.

References