Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19780

Koha Eval Code Injection Remote Code Execution Vulnerability

CVSS 3.0 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19780

Published

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19780

Published

Koha

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Koha",
                    "product": "Koha",
                    "versions": [
                        {
                            "version": "25.12.00",
                            "status": "affected"
                        }
                    ],
                    "defaultStatus": "unknown"
                }

Original source record · Cite this exact observation · Complete original publisher JSON