CVE-2026-105106 Koha Community CVE debrief

Who should care

Koha administrators and users with tools => schedule_tasks permission should assess exposure and apply patches or mitigations as needed. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Koha administrators and users with tools => schedule_tasks permission are impacted by this vulnerability.

Why it matters

Authenticated OS command injection vulnerability in Koha's tools/scheduler.pl via the jobid parameter when deleting a scheduled task, allowing potential for arbitrary OS command execution as the Koha web/application user.

• Potential for arbitrary OS command execution as the Koha web/application user
• Possible disruption of Koha services
• Need for verification of affected versions and exposure
• Priority for patching or mitigating vulnerable Koha installations

Technical summary

The tools/scheduler.pl handler in Koha accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch. This technical summary provides affected product context, defensive impact, and source-grounded technical framing.

Defensive priority

High priority for Koha administrators and users with tools => schedule_tasks permission

Recommended defensive actions

• Review and apply patches for Koha versions 24.11.20, 25.05.15, 25.11.09, and 26.05.04
• Restrict access to tools/scheduler.pl to authorized users only
• Monitor for suspicious activity on Koha systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. Evidence limits are based on the information provided in the CVE record and source item. Defenders should verify the affected scope, severity, and vendor guidance. The CVE record was published on 2026-10-14T07:23:03.069Z and has not been modified since then. No additional information is available beyond what is provided in the CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.