CVE-2026-105106: Koha Task Scheduler RCE Vulnerability

CVE-2026-105106 Overview

CVE-2026-105106 is an operating system command injection vulnerability in the Koha integrated library system. The flaw resides in the Task Scheduler deletion path exposed by tools/scheduler.pl. The handler accepts the jobid request parameter for the op=cud-delete operation and passes it directly to C4::Scheduler::remove_at_job without validation. Schedule::At::remove then substitutes the job ID into an atrm command string and executes it through a single-argument system() call, which invokes a shell. Authenticated staff users holding the tools => schedule_tasks permission can inject shell metacharacters and execute arbitrary commands as the Koha web application user [CWE-78].

Critical Impact

Authenticated staff users can execute arbitrary operating-system commands as the Koha application user, enabling full compromise of the hosting server and the library catalog.

Affected Products

• Koha versions prior to 24.11.20
• Koha versions prior to 25.05.15 and 25.11.09
• Koha versions prior to 26.05.04 and 26.11 development branch

Discovery Timeline

• 2026-10-14 - CVE-2026-105106 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105106

Vulnerability Analysis

The vulnerability exists in the Task Scheduler deletion workflow of Koha. When a staff user submits a request to tools/scheduler.pl with op=cud-delete, the handler extracts the jobid parameter from the request. It forwards that value unmodified to C4::Scheduler::remove_at_job, which calls Schedule::At::remove. The downstream Perl module constructs an atrm shell command by concatenating the attacker-controlled job identifier into the command string. Because system() receives a single string argument, Perl delegates execution to /bin/sh, which interprets shell metacharacters such as ;, |, backticks, and $(). Any content supplied in jobid is parsed by the shell before atrm runs.

Root Cause

The root cause is missing input validation combined with unsafe command construction. Neither the Koha handler nor the Schedule::At dependency quote, escape, or constrain the jobid parameter to the expected numeric format. Invoking system() with a single concatenated string triggers shell interpretation, converting a parameter-handling defect into arbitrary command execution.

Attack Vector

Exploitation requires an authenticated staff account with the tools => schedule_tasks permission. The attacker issues an HTTP request to tools/scheduler.pl with op=cud-delete and a crafted jobid value containing shell metacharacters. The injected payload executes with the privileges of the Koha web or application user, providing access to the catalog database, patron records, and the underlying host filesystem.

No verified public exploit code is available at the time of publication. Refer to the Koha Bug Report #42674 for additional technical context.

Detection Methods for CVE-2026-105106

Indicators of Compromise

• Web server access logs containing requests to tools/scheduler.pl with op=cud-delete and jobid values that include shell metacharacters such as ;, |, &, backticks, or $(.
• Unexpected child processes of the Koha web or application process, including shells, network utilities, or package managers.
• New or modified cron entries, SSH authorized keys, or files written by the Koha runtime user outside of normal application paths.

Detection Strategies

• Review Apache or Plack access logs for scheduler.pl POST requests whose jobid parameter does not match a strict numeric pattern.
• Correlate staff account authentication events with scheduler deletion requests to identify abuse of the schedule_tasks permission.
• Hunt for process-execution telemetry showing atrm invocations with non-numeric arguments or shell interpreters spawned by the Koha service account.

Monitoring Recommendations

• Enable verbose logging on tools/scheduler.pl and forward it to a centralized log platform for retention and alerting.
• Alert on any outbound network connection initiated by the Koha application user, which typically should not initiate egress traffic.
• Audit staff accounts holding the tools => schedule_tasks permission and monitor privilege assignment changes.

How to Mitigate CVE-2026-105106

Immediate Actions Required

• Upgrade Koha to a fixed release: 24.11.20, 25.05.15, 25.11.09, or 26.05.04.
• Revoke the tools => schedule_tasks permission from all staff accounts that do not require it until the patch is applied.
• Rotate credentials and inspect the Koha host for signs of post-exploitation activity, including unauthorized processes, files, and cron jobs.

Patch Information

The Koha project has released fixed versions 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and merged the fix into the 26.11 development branch. Patched builds are available from Koha Community Downloads. Related historical issues in the same component are documented in CVE-2024-28739 and CVE-2025-30076.

Workarounds

• Block or filter HTTP requests to tools/scheduler.pl with op=cud-delete at a reverse proxy or web application firewall until patching completes.
• Restrict the tools => schedule_tasks permission to a minimal set of trusted staff accounts and require multi-factor authentication for those users.
• Run the Koha web application under a dedicated, unprivileged service account with no shell, no sudo rights, and restricted filesystem permissions.

# Example WAF rule concept to block non-numeric jobid values
# Reject POSTs to scheduler.pl where jobid contains shell metacharacters
SecRule REQUEST_URI "@endsWith /tools/scheduler.pl" \
  "chain,deny,status:403,id:1050106,msg:'Koha CVE-2026-105106 jobid injection'"
  SecRule ARGS:jobid "!@rx ^[0-9]+$"