CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

• CWE-78

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674
• https://download.koha-community.org/
• https://www.cve.org/CVERecord?id=CVE-2024-28739
• https://www.cve.org/CVERecord?id=CVE-2025-30076
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105097A vulnerability was identified in Omega Solution CoinEx Cryp…4.3
• CVE-2026-105098A security flaw has been discovered in Omega Solution CoinEx…4.3
• CVE-2026-105099A weakness has been identified in Omega Solution CoinEx Cryp…3.5
• CVE-2026-1051The Newsletter – Send awesome emails from WordPress plugin f…4.3
• CVE-2026-10510Cross-Site Scripting (XSS) in GeniexWebView component in Tra…6.1
• CVE-2026-105105CWE-306: Missing Authentication for Critical Function in the…9.8
• CVE-2026-105107Koha is vulnerable to SQL injection in the Most-circulated i…7.6
• CVE-2026-105110OS Command Injection in the login.xgi CGI endpoint in Iskrat…9.8
• CVE-2026-105111Improper neutralization of input during web page generation …4.7
• CVE-2026-105112Nezha from 1.8.0 before 2.3.13 contains a lock-order inversi…5.3
• CVE-2026-105113Nezha Dashboard from 1.8.0 before 2.3.13 contains an imprope…6.5
• CVE-2026-105114OpenAM before 16.1.3 contains a reflected cross-site scripti…6.1