Koha: OS command injection in Task Scheduler deletion path
Summary
Koha, an open-source library management system, contains an OS command injection in the Task Scheduler job deletion handler (tools/scheduler.pl, op=cud-delete). The jobid parameter is passed unvalidated into an atrm command executed through a shell. An authenticated staff user with the schedule_tasks permission can run arbitrary operating-system commands as the Koha web/application user, with full impact on confidentiality, integrity and availability.
Affected
- Koha versions below 24.11.20
- Koha 24.11.00 to below 24.11.20
- Koha 25.05.00 to below 25.05.15
- Koha 25.11.00 to below 25.11.09
- Koha 26.05.00 to below 26.05.04
- Versions below 24.11 are listed as affected by the CNA; whether they received a fix is unknown.
Fixed in
- Koha 24.11.20
- Koha 25.05.15
- Koha 25.11.09
- Koha 26.05.04
- Koha 26.11 development branch
Workaround
Unknown. No vendor workaround found; apply the vendor patches.
Exploitation
- Not listed in CISA KEV at the time of research.
- No public exploit confirmed; the CISA SSVC lists exploitation as poc.
- EPSS 0.0188 at the time of the Positive Technologies record.
- Authentication with the schedule_tasks permission is required; CISA SSVC lists automatable as no.
Our recommendation
- Upgrade Koha to a fixed release (24.11.20, 25.05.15, 25.11.09, 26.05.04 or later).
- Review which accounts hold the schedule_tasks permission and remove it where not needed.
- Keep the staff interface off the public internet or behind VPN.
- Check the scheduler job list for unexpected entries after patching.
- Confirm the status of any Koha versions older than 24.11 with the vendor or your provider.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Koha Bugzilla bug 42674 bugs.koha-community.org
- Koha download page download.koha-community.org
- Koha 24.11.20 LTS release notes koha-community.org
- Koha 25.05.15 release notes koha-community.org
- Koha 25.11.09 release notes koha-community.org
- CVE-2026-105106 on vulners.com vulners.com
- CVE-2026-105106 on Strix www.strix.ai
- CVE-2026-105106 on TheHackerWire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:53.
Original description (NVD)
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.