CVE-2026-105106: Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => scheduletasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kohato a version that resolves this vulnerability.Fixed in 24.11.20
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated Koha staff user must have the tools => schedule_tasks permission. The attack is performed through the Task Scheduler deletion operation.
What level of access could an attacker gain?
The attacker can execute arbitrary operating-system commands as the Koha web/application user. This can affect confidentiality, integrity, and availability of the host and resources accessible to that user.
Are installations fixed by upgrading to a listed release?
Yes. Fixed releases are Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04; the 26.11 development branch is also fixed.
What should be restricted while an affected installation remains unpatched?
Restrict the tools => schedule_tasks permission to trusted staff, since that permission is required to reach the vulnerable scheduler deletion path.