CVE-2026-105106 | Koha Community up to 26.05.3 Task Scheduler tools/scheduler.pl remove_at_job jobid os command injection

October 14, 2026 Yanac

A vulnerability was found in Koha Community Koha up to 24.10.x/24.11.19/25.05.14/25.11.8/26.05.3 and classified as critical. This affects the function C4::Scheduler::remove_at_job of the file tools/scheduler.pl of the component Task Scheduler. Executing a manipulation of the argument jobid can lead to os command injection.

This vulnerability is handled as CVE-2026-105106. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More