CVE-2026-105106

Executive Summary

CVE-2026-105106 is an OS command injection vulnerability in Koha, the open-source integrated library system, located in the Task Scheduler deletion path exposed through tools/scheduler.pl. An authenticated staff user holding the tools => schedule_tasks permission can inject shell metacharacters into the jobid parameter, which is passed unvalidated to C4::Scheduler::remove_at_job and ultimately substituted into an atrm command executed via a single-argument system() call, yielding arbitrary command execution as the Koha web/application user. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and is rated UNPATCHED by tracked patch sources; remediation requires upgrading to the fixed release lines.

Technical Analysis

Koha is a widely deployed, Perl-based integrated library system (ILS) used by public, academic, and special libraries worldwide. It exposes a staff client and an OPAC (online public access catalog) web interface, typically deployed as a web application under a service account.

The vulnerability resides in the Task Scheduler feature. Koha allows staff to schedule tasks through a backend built on the system at/atrm facility, which is wrapped by the Schedule::At Perl module. The NVD description states the following chain explicitly:

1. The handler tools/scheduler.pl accepts the request parameter jobid for the operation op=cud-delete (create/update/delete — delete path).
2. The value of jobid is passed to C4::Scheduler::remove_at_job without validation.
3. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it.
4. The resulting string is executed through a single-argument system() call, which invokes the shell (/bin/sh -c "...").
5. Because the command string is not quoted or escaped, shell metacharacters supplied in jobid are interpreted by the shell, allowing arbitrary OS command execution.

The root cause is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) pattern: untrusted input concatenated into a shell command. The use of a single-argument system() is the decisive factor — Perl's single-argument system() form runs the string through the shell, whereas the multi-argument (list) form would bypass the shell entirely. The missing quoting/escaping in Schedule::At::remove is the second contributing defect. Together, attacker-controlled data reaches a shell with no neutralization.

The attack surface is the staff-facing Task Scheduler administrative interface. Exploitation requires an authenticated session with the tools => schedule_tasks permission. This is a lower-privileged but non-trivial account — typically catalogers, systems librarians, or technical services staff. The vulnerability is network-reachable (AV:N), low complexity (AC:L), requires low privileges (PR:L), needs no user interaction (UI:N), and impacts confidentiality, integrity, and availability equally at High severity (C:H/I:H/A:H) with scope unchanged (S:U).

No public proof-of-concept, exploit code, or Nuclei template was available at the time of analysis. The attack chain is therefore described below at the vulnerability-class level, consistent with the NVD description.

Exploitation Scenarios

Because no public PoC exists, the following chain is inferred directly from the NVD description and the command-injection vulnerability class. No implementation details beyond those stated in the description are assumed.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-facing Koha instance (e.g., via Shodan/HTTP fingerprints such as the Koha login page or catalog HTML). The attacker must obtain valid staff credentials — through credential stuffing, phishing, password reuse, or an insider role — and confirm the account possesses the tools => schedule_tasks permission. Koha staff accounts with this permission can access the Task Scheduler interface (tools/scheduler.pl).

2. Triggering the flaw. The authenticated staff user sends a crafted request to tools/scheduler.pl with op=cud-delete and a manipulated jobid parameter. The jobid value is not validated in the handler and is forwarded to C4::Scheduler::remove_at_job, which invokes Schedule::At::remove. That module builds an atrm command string by direct substitution of the job ID, without quoting or escaping.

3. Payload / execution method. The attacker appends shell metacharacters to the jobid value (for example a command separator or substitution sequence) so that when the constructed string is executed, the trailing attacker-supplied text is interpreted by the shell as an additional command. Because the call is a Perl single-argument system(), the string is handed to the shell, so the injected command runs in the context of the Koha web/application user. The exact metacharacters and payload syntax are left to the attacker; the vulnerability class is OS command injection via unchecked jobid concatenation into an atrm invocation.

4. Post-exploitation impact. A successful injection executes arbitrary OS commands as the Koha web/application user. This typically yields read/write access to the Koha database configuration (including database credentials stored in koha-conf.xml), patron and staff data, and the application codebase — potentially enabling persistence (modifying config or cron), lateral movement toward the database backend, and exfiltration of patron personally identifiable information and credentials. The High confidentiality, integrity, and availability ratings reflect this breadth of impact.

Impact Assessment

CVSS v3.1: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (High): Command execution as the Koha application user exposes database credentials, patron PII (names, addresses, borrowing history), staff credentials, and possibly system secrets. Library patron data is often subject to privacy regulation.
• Integrity (High): An attacker can alter application files, database contents, scheduled tasks, and configuration, undermining catalog and circulation integrity.
• Availability (High): Arbitrary command execution permits service disruption, deletion of data, or resource exhaustion against the web/application user and host.
• Scope (Unchanged): Impact is scored as confined to the Koha application context, though in practice lateral movement toward the database and host is feasible from that foothold.
• Privileges Required (Low): Any authenticated staff user with the tools => schedule_tasks permission qualifies — a broader population than system administrators, increasing the realistic attacker pool (insider risk, compromised staff accounts).
• Blast radius: Every Koha deployment running a version prior to 24.11.20 / 25.05.15 / 25.11.09 / 26.05.04 (and the 26.11 development branch) that exposes the staff Task Scheduler is potentially affected. Libraries are frequently internet-facing to serve OPAC users, and the staff interface is often reachable remotely, widening exposure. Because Koha is a shared platform across consortia, a single compromised instance can affect member libraries' shared data.

No EPSS score is available (not yet scored by FIRST.org). CISA KEV does not list this CVE, and no exploit code, PoC, or Nuclei template was observed.

Detection Guidance

Sigma Rule

title: Koha Task Scheduler OS Command Injection Attempt (CVE-2026-105106)
id: 7d3f1a92-6c2e-4b8a-9f10-2b5c8e4d1a77
status: experimental
description: Detects shell metacharacters in the Koha tools/scheduler.pl jobid parameter on the cud-delete path, indicating CVE-2026-105106 OS command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105106
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1059
  - attack.execution
  - cve.2026-105106
logsource:
  category: webserver
  product: koha
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/tools/scheduler.pl'
  selection_op:
    cs-uri-query|contains: 'op=cud-delete'
  selection_injection:
    cs-uri-query|contains:
      - 'jobid='
  filter_benign:
    cs-uri-query|re: 'jobid=[0-9]+(&|$)'
  condition: selection_endpoint and selection_op and selection_injection and not filter_benign
falsepositives:
  - Legitimate job IDs containing unexpected characters (rare)
level: high

YARA Rule

rule CVE_2026_105106_Koha_Command_Injection
{
    meta:
        description = "Detects exploit requests for CVE-2026-105106 Koha tools/scheduler.pl OS command injection"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105106"
        cve = "CVE-2026-105106"

    strings:
        $scheduler = "tools/scheduler.pl" ascii nocase
        $op_delete = "op=cud-delete" ascii nocase
        $jobid     = "jobid=" ascii nocase
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "`" ascii
        $meta4 = "$(" ascii
        $meta5 = "&&" ascii

    condition:
        $scheduler and $op_delete and $jobid and any of ($meta*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105106 Koha Task Scheduler OS Command Injection Attempt"; flow:established,to_server; http.uri; content:"/tools/scheduler.pl"; http.uri; content:"op=cud-delete"; http.uri; content:"jobid="; pcre:"/jobid=[^&]*(%3B|;|%7C|\||%60|`|%24%28|\$\(|%26%26|&&)/Ui"; reference:cve,CVE-2026-105106; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-105106; classtype:web-application-attack; sid:2026105106; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      url.path contains "/tools/scheduler.pl" and
      url.query contains "op=cud-delete" and
      url.query contains "jobid=" ]

Complementary EQL for high-confidence injection markers:

any where
  url.path contains "/tools/scheduler.pl" and
  url.query contains "op=cud-delete" and
  (
    url.query regex~ "jobid=[^&]*(;|\\||`|\\$\\(|&&)"
  )

Splunk SPL Query

index=web sourcetype=access_common OR sourcetype=nginx:access
| search uri_path="/tools/scheduler.pl" (uri_query="*op=cud-delete*" uri_query="*jobid=*")
| rex field=uri_query "jobid=(?<jobidval>[^&]+)"
| where match(jobidval, "(;|\||`|\$\(|&&|%3[bB]|%7[cC]|%60|%24%28)")
| stats count min(_time) as first_seen max(_time) as last_seen values(jobidval) as payloads by src_ip, uri_path, status
| sort - count
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Wazuh OSSEC Rule

<group name="koha,web,attack,">
  <rule id="1051060" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>tools/scheduler\.pl</url>
    <regex type="pcre2">op=cud-delete</regex>
    <regex type="pcre2">jobid=[^&amp;]*(%3[bB]|%7[cC]|%60|%24%28|;|\||`|\$\(|&amp;&amp;)</regex>
    <description>CVE-2026-105106: Koha Task Scheduler OS command injection attempt via jobid parameter</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_105106,</group>
  </rule>

  <rule id="1051061" level="10">
    <if_sid>1051060</if_sid>
    <status>^200$</status>
    <description>CVE-2026-105106: Possible successful Koha command injection (injection returned HTTP 200)</description>
    <group>cve_2026_105106,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix confirmed as applied):

   • Remove or restrict the tools => schedule_tasks permission from all staff accounts that do not strictly require it; apply least privilege to reduce the exploitable attacker pool.
   • Place the Koha staff interface behind a VPN, zero-trust proxy, or IP allowlist so tools/scheduler.pl is not internet-reachable.
   • Enforce strong authentication and MFA for staff accounts to prevent credential-based access to the scheduler.
   • Where operationally feasible, disable or block the Task Scheduler feature until an upgrade can be performed.
   • Deploy web application firewall (WAF) rules to reject jobid values containing shell metacharacters (;, |, `, $(, &&) on tools/scheduler.pl.
   • Monitor for suspicious child processes (e.g., shell spawning from the Koha web user) as a compensating control.

2. Patch / upgrade steps:

   • Upgrade to a fixed release: Koha 24.11.20, 25.05.15, 25.11.09, or 26.05.04. The 26.11 development branch is also fixed.
   • Because patch-source confidence is 0/4, independently verify the fix against the vendor repository and release notes before relying on it, and confirm the applied version after upgrade.
   • Back up the database and configuration before upgrading; validate the scheduler functionality post-upgrade.

3. Long-term hardening:

   • Adopt strict input validation and output encoding for all parameters passed to OS-level commands; eliminate shell invocation by replacing single-argument system() calls with list-form execution or library APIs.
   • Replace the at/atrm command-string construction with argument-safe process invocation that does not pass through the shell.
   • Run the Koha application under a dedicated, minimally privileged service account with no unnecessary filesystem or network access.
   • Establish a routine patch cadence aligned with Koha release cadence and subscribe to vendor security announcements.
   • Log and alert on all staff Task Scheduler activity and integrate the detection rules above into the SOC.

References

• NVD — CVE-2026-105106: https://nvd.nist.gov/vuln/detail/CVE-2026-105106
• Koha Project (official site / security announcements): https://koha-community.org/
• Koha Community Release Notes (fixed versions 24.11.20, 25.05.15, 25.11.09, 26.05.04): https://koha-community.org/download-koha/
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html

No known threat actor campaigns, exploit-in-the-wild evidence, public PoC, exploit code, or Nuclei template were identified for this CVE at the time of writing. CVE-2026-105106 is not listed in CISA KEV, and no EPSS score is currently available.