CVE-2026-105106: Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-15
Weakness: CWE-78

Description

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

Affected products

Koha Community Koha: before 24.11.00; from 24.11.00 before 24.11.20; from 25.05.00 before 25.05.15; from 25.11.00 before 25.11.09; from 26.05.00 before 26.05.04 — fixed in 24.11.00, 24.11.20, 25.05.15, 25.11.09, 26.05.04

How to fix

Upgrade to a fixed version: Koha Community Koha 24.11.00, 24.11.20, 25.05.15, 25.11.09. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-105106 or the next vulnerability affects your stack