{"id":"CVE-2026-105106","revision":"2df254ffa1cd4885a2cb58744277154b","records":[{"revision":"2df254ffa1cd4885a2cb58744277154b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105106","aliases":[],"title":"Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task","description":"Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.","state":0,"publishedAt":"2026-10-14T07:23:03.069+00:00","modifiedAt":"2026-10-14T17:56:36.316+00:00","affected":[{"ecosystem":"Vendor product","name":"Koha","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Koha Community\",\n                    \"product\": \"Koha\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"24.11.00\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"24.11.00\",\n                            \"lessThan\": \"24.11.20\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"25.05.00\",\n                            \"lessThan\": \"25.05.15\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"25.11.00\",\n                            \"lessThan\": \"25.11.09\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"26.05.00\",\n                            \"lessThan\": \"26.05.04\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674","https://download.koha-community.org/","https://www.cve.org/CVERecord?id=CVE-2025-30076","https://www.cve.org/CVERecord?id=CVE-2024-28739"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105106","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105106","identifiers":["CVE-2026-105106"]},"retained":false,"historicalAffected":[]}],"coverage":[]}