CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
Authenticated staff users can execute arbitrary OS commands via the jobid parameter in the task scheduler deletion path.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105106?
CVE-2026-105106 is a high-severity command injection vulnerability in Koha, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
Weakness: CWE-78
Which versions are affected by CVE-2026-105106?
How do I fix CVE-2026-105106?
No fix has been published for CVE-2026-105106 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-105106 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105106 exists.
Sources
Also known as GHSA-8cv9-2m24-2x49.