CVE-2026-105106

The Koha library is vulnerable to OS command injection within the Task Scheduler deletion path. The tools/scheduler.pl handler accepts a jobid parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without proper validation. Specifically, Schedule::At::remove substitutes the un...

EUVD-2026-100897

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...