What’s Vulnerable › Vulnerabilities

CVE-2025-30076

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-16 · updated 2026-06-17
• Weakness: CWE-78

Description

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.

Affected products

• Koha Community Koha: before 22.11.24; from 23 before 23.11.12; from 24 before 24.05.07; from 24.06 before 24.11.02 — fixed in 22.11.24, 23.11.12, 24.05.07, 24.11.02

How to fix

Upgrade to a fixed version: Koha Community Koha 22.11.24, 23.11.12, 24.05.07, 24.11.02. Check the vendor advisory for mitigations.

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170
• https://github.com/gl0wyy/koha-task-scheduler-rce
• https://github.com/gl0wyy/koha-task-scheduler-rce

Get alerted when CVE-2025-30076 or the next vulnerability affects your stack