CVE-2026-19780

Executive Summary

CVE-2026-19780 is a code injection vulnerability in Koha, the open-source integrated library system, in which the application passes a user-supplied string to the eval function without proper validation (CWE-95). The flaw resides in a web service that listens on TCP port 8081 by default; successful exploitation allows a remote attacker to execute arbitrary code in the context of the service account, but requires authentication (CVSS PR:L). With a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is rated High severity and, because the injected value is passed to eval, it carries complete loss-of-integrity and loss-of-confidentiality potential.

Technical Analysis

The vulnerability class here is code injection via dynamic evaluation — CWE-95, "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')." Per the NVD description, the specific flaw exists "within the web service, which listens on TCP port 8081 by default," and the issue "results from the lack of proper validation of a user-supplied string before passing it to the eval function." The attacker-supplied string is therefore interpreted as code rather than treated as inert data.

The root cause is a trust-boundary failure: data that originates from an HTTP request to the web service is treated as executable program text. In an interpreted runtime, eval (or an equivalent runtime-evaluation primitive) compiles and executes the supplied string with the full privileges of the calling process. Because validation is absent, there is no allow-list, type check, or syntactic restriction preventing an attacker from embedding arbitrary expressions, statements, or OS-level calls into the string. The description does not identify the exact scripting language, language runtime, parameter name, endpoint path, or function name involved — those specifics are not derivable from the supplied data and are deliberately not fabricated here. What can be stated with confidence is that the evaluation occurs server-side, on the network-facing web service bound to TCP/8081, and that the resulting code executes under the service account identity.

The attack surface is the web service's TCP/8081 listener. This is significant because 8081 is typically a secondary or management-style HTTP port rather than the primary 80/443 web tier, meaning it may be exposed only on internal networks, behind a reverse proxy, or within a container/host overlay — yet it may also be directly reachable if deployed without network segmentation. The authentication requirement (PR:L) means an attacker needs at least one valid low-privileged session to the service, which materially changes the threat profile compared to an unauthenticated RCE: the initial access vector is likely compromised, default, or self-registered credentials, or an authenticated insider.

The scope is Unchanged (S:U), so the vulnerable service cannot, by itself, exercise authority over other security scopes beyond what the service account already holds; however, the confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), reflecting that arbitrary code execution in the service process typically yields read/write of application data and the ability to terminate or degrade the service.

Exploitation Scenarios

No public proof-of-concept, Metasploit module, or Nuclei template is available for CVE-2026-19780 (PoC_STATUS: None; ZDI-CAN-29165 is the originating advisory identifier). The following attack chain is therefore reconstructed at the vulnerability-class level from the NVD description and does not assume any specific parameter, endpoint, or function name.

1) Reconnaissance and target identification. An attacker enumerates hosts and identifies the Koha web service listening on TCP port 8081. Port 8081 is unusual enough that exposure frequently results from a non-standard deployment (container mapping, reverse proxy, or appliance-style installation), so discovery commonly occurs through internet-wide scanning or internal network sweep. The attacker then confirms the service is reachable and identifies an authenticated entry point.

2) Authentication and precondition satisfaction. The vulnerability explicitly requires authentication (CVSS PR:L). The attacker must obtain a valid, low-privileged account and an active session. Candidate paths include weak or default staff credentials, self-registration where enabled, credential stuffing against the staff interface, or reuse of a leaked credential. Only after obtaining a session does the attacker reach the vulnerable web-service function.

3) Triggering the flaw class. The attacker submits a crafted string through the user-supplied input that feeds the vulnerable evaluation path. Because the string is passed to eval without validation, the interpreter treats the attacker's text as code. In the generic eval-injection pattern, the payload is an arbitrary expression or statement sequence that the runtime compiles and executes server-side. No specific payload syntax, parameter name, or endpoint should be assumed from the available data — the exact request shape is undocumented publicly, and attempting to publish a concrete payload without a working reference would be speculative.

4) Execution and post-exploitation impact. The evaluated code runs in the context of the service account, granting the attacker the ability to read and modify application data (C:H/I:H), disrupt availability (A:H), and pivot within the privileges available to that account. Realistic objectives for a library system include exfiltration of patron records and personally identifiable information, tampering with catalog and circulation data, and using the server as a foothold for lateral movement into the library network. Persistence would depend on the underlying OS account privileges, which the advisory does not specify.

Impact Assessment

CVE-2026-19780 has a CVSS 3.0 base score of 8.8 (High) with the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The subscores read as follows:

• Attack Vector (AV:N) — exploitable over the network, consistent with a web service on TCP/8081.
• Attack Complexity (AC:L) — no special conditions beyond the preconditions noted; the flaw is directly reachable once authenticated.
• Privileges Required (PR:L) — the attacker needs a valid low-privileged account. This is the single most important mitigating factor and the reason the score is 8.8 rather than 9.8.
• User Interaction (UI:N) — no victim action is required; the attacker drives the request itself.
• Scope (S:U) — impact is confined to the vulnerable service's own security authority.
• Confidentiality (C:H) — full read access to data reachable by the service account, including patron PII, circulation histories, and credentials held in the application.
• Integrity (I:H) — arbitrary code execution permits arbitrary modification of application data and logic.
• Availability (A:H) — the attacker can crash or degrade the service at will.

Business impact. Koha underpins library operations: circulation, cataloging, patron records, acquisitions, and often interlibrary loan and single-sign-on integrations. A compromise can result in unauthorized access to patron personally identifiable information, integrity loss in authoritative catalog and loan records, and service downtime affecting library users. Because the affected instance may also hold integration credentials (SIP2, LDAP/SSO, payment or fine-processing connectors), the effective blast radius can extend beyond the library system itself. For regulated organizations (public libraries, universities, and any institution subject to privacy law), exposure of patron data carries notification and compliance obligations.

Blast radius. The CVSS scope is Unchanged, so impact is bounded by the privileges of the service account. Organizations should, however, assume that a service account running a library application holds database access to the full Koha schema, meaning that although the vulnerability's formal scope is limited, the practical data exposure can be organization-wide with respect to library data.

Detection Guidance

Detection for this class of vulnerability centers on (a) identifying and monitoring the non-standard TCP/8081 web listener, (b) detecting code-like strings traversing that listener, and (c) alerting on process behavior consistent with interpreter spawning. Because the vulnerable parameter is not publicly documented, the network and host detections below are necessarily behavioral and heuristic rather than signature-exact.

Sigma Rule

title: Koha Web Service Potential Eval Injection Activity (CVE-2026-19780)
id: 7f3c1a92-2b6d-4f1a-9c2e-0e5b8a1d4c77
status: experimental
description: Detects suspicious code-like content or interpreter invocation associated with the Koha web service on TCP/8081, where user input is passed to eval without validation (CWE-95).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19780
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.95
logsource:
  product: webserver
  service: access
detection:
  selection_port:
    dst_port: 8081
  selection_suspicious:
    uri|contains:
      - 'eval'
      - 'system('
      - 'exec('
      - 'subprocess'
      - 'Runtime.getRuntime'
      - '${'
      - 'os.popen'
  selection_flags:
    cs-method:
      - 'POST'
      - 'GET'
  condition: selection_port and selection_suspicious and selection_flags
fields:
  - src_ip
  - c-ip
  - cs-method
  - cs-uri-query
  - user_agent
falsepositives:
  - Legitimate administrative tooling that submits code-like strings to the web service
  - Debug or development instances of Koha
level: high

YARA Rule

rule CVE_2026_19780_Koha_Eval_Injection_Indicators
{
    meta:
        description = "Heuristic indicators of code-injection payloads targeting Koha web service eval sink (CVE-2026-19780, CWE-95)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19780"
        date = "2026-01-01"
        severity = "high"

    strings:
        $eval_sink = "eval(" ascii wide nocase
        $exec_sink = "Runtime.getRuntime().exec" ascii wide
        $shell_call = "subprocess" ascii wide nocase
        $backtick  = "`id`" ascii wide
        $cmdi_like = "$(" ascii wide
    condition:
        filesize < 2MB and
        $eval_sink and
        ( $exec_sink or $shell_call or $backtick or $cmdi_like )
}

Note: the YARA rule above is a heuristic content matcher intended to flag suspicious request/response artifacts captured during incident triage. It does not identify a specific exploit and will not match the vulnerability without supporting capture data.

Suricata IDS Rule

alert tcp any any -> any 8081 ( \
  msg:"CVE-2026-19780 Koha web service potential eval/code injection attempt (CWE-95)"; \
  flow:established,to_server; \
  content:"POST"; http_method; \
  content:"eval"; http_uri; nocase; \
  content:"("; http_uri; distance:4; within:2; \
  classtype:web-application-attack; \
  reference:cve,2026-19780; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19780; \
  sid:2026197801; rev:1; )

This rule is a behavioral tripwire for code-like tokens in requests to the non-standard 8081 web listener; it is not an exploit signature, because no public exploit string exists for this CVE.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where destination.port == 8081 and
      network.transport == "tcp" and
      url.path : "*" and
      event.action in ("connection_attempt", "network_flow") ]
  [ process where event.type == "start" and
      process.parent.name in ("java", "perl", "python", "ruby", "php", "node") and
      process.name in ("sh", "bash", "cmd.exe", "powershell.exe", "curl", "wget") ]

Rationale: this correlated sequence highlights the classic eval-injection outcome — a request to the Koha web service on TCP/8081 followed shortly by a shell or downloader process spawned as a descendant of the service runtime.

Splunk SPL Query

index=web OR index=proxy OR index=network
(dest_port=8081 OR url_port=8081)
| eval suspicious=if(match(lower(uri), "(eval|system\(|exec\(|subprocess|runtime\.getruntime|\$\()") ,1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources values(uri) as uris
        by dest_ip, dest_port
| where count >= 3
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Tune the threshold (count >= 3) per environment; a single hit from new infrastructure is often sufficient to justify investigation in library environments where the 8081 listener has no legitimate automated clients.

Wazuh OSSEC Rule

<group name="koha,web,cve_2026_19780,">
  <rule id="202619780" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="dstport">8081</field>
    <regex type="pcre2">(?i)(eval\s*\(|system\s*\(|Runtime\.getRuntime|\bsubprocess\b|\bexec\s*\()</regex>
    <description>CVE-2026-19780: Possible code (eval) injection attempt against Koha web service on port 8081.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_19780,web_attack,</group>
  </rule>

  <rule id="202619781" level="13">
    <if_sid>202619780</if_sid>
    <field name="dstport">8081</field>
    <same_source_ip />
    <description>CVE-2026-19780: Repeated eval injection attempts from same source - likely active exploitation.</description>
    <group>cve_2026_19780,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or advisory has been tracked for CVE-2026-19780 from any source. No affected-version range and no OSV package mapping are available, which means defenders cannot currently rely on version-based detection to determine exposure and must inventory Koha deployments directly.

1) Immediate mitigations.

• Restrict access to TCP/8081. This is the single highest-value control. The vulnerability lives in the web service on port 8081; if that listener is reachable only from a trusted management network, host firewall, or bastion, the attack surface collapses. Add explicit deny rules at host and network layers and confirm the port is not internet-exposed.
• Review authentication. Because exploitation requires a valid low-privileged session, enforce strong, unique credentials for all accounts with access to the service, disable unused accounts, and eliminate any default or shared logins.
• Monitor the service account. Any code executed by this flaw runs as the service account, so alerting on command execution, unexpected process spawns, and outbound connections from that account provides coverage even in the absence of a patch.
• Increase logging on the 8081 listener. Ensure request logs retain full query strings and URIs to support retro-hunting once the vulnerable parameter is published.

2) Patch/upgrade steps.

• Monitor the NVD entry (CVE-2026-19780), the Koha security advisories, and the originating ZDI advisory (ZDI-CAN-29165) for a fixed release.
• Given zero patch evidence, do not assume the latest release is fixed. When a patch is issued, treat upgrade as emergency-change priority: apply to an inventory of all Koha instances, validate the 8081 web service behavior, and retain rollback capability.
• Until a fixed release exists, if the web service on 8081 is non-essential to operations, disable or firewall it off entirely. This is the most reliable pre-patch mitigation available.

3) Long-term hardening.

• Eliminate dynamic evaluation. Development teams maintaining Koha or its extensions should replace eval-style constructs with safe parsers, allow-listed dispatch tables, or structured data formats. Any remaining eval sink handling user input should be treated as a defect regardless of CVE status.
• Network segmentation. Library applications should not share network reachability with general user networks or the open internet on non-standard ports.
• Least privilege for the service account. The service account running the application should hold only the filesystem, database, and network permissions it needs; this directly bounds the "context of the service account" exploitation outcome described in the advisory.
• Continuous detection. Keep the Sigma, YARA, Suricata, Elastic, Splunk, and Wazuh content above deployed and tuned. Given the absence of a public PoC or Nuclei template, behavioral detection of code-like input and post-exploitation process activity is the primary compensating control.
• Vulnerability management. Track Koha specifically; because no affected version range is published, periodically re-scan for exposure on TCP/8081 and re-verify authentication posture.

References

1. NVD — CVE-2026-19780 — https://nvd.nist.gov/vuln/detail/CVE-2026-19780 — primary record; describes the eval code injection in the Koha web service on TCP/8081, authentication requirement, and CVSS 8.8 vector.
2. MITRE CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') — https://cwe.mitre.org/data/definitions/95.html — authoritative definition of the vulnerability class.
3. Zero Day Initiative advisory originating this case (ZDI-CAN-29165) — referenced in the NVD description as the source identifier; consult the ZDI published advisories index at https://www.zerodayinitiative.com/advisories/ for the corresponding write-up when released.
4. Koha project security advisories and release notes — https://koha-community.org/ — track for the eventual fixed release and affected-version range; no patch is currently cited for this CVE.
5. CISA Known Exploited Vulnerabilities catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-19780 is not listed; no evidence of in-the-wild exploitation or named threat-actor campaign is currently available.

Exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no KEV listing. EPSS has not yet been scored by FIRST.org. Treat exploitation as plausible but unproven, and prioritize exposure reduction on TCP/8081 accordingly.