CVE-2026-105106 - Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
CVE ID :CVE-2026-105106 Published : Oct. 14, 2026, 7:23 a.m. | 9 minutes ago Description :Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to...