Executive brief
Koha is a popular open-source library management system used by institutions worldwide to manage book catalogs, patron records, and circulation operations. This vulnerability allows authenticated users to execute arbitrary code on the server by injecting malicious input into an unvalidated parameter processed by the eval function, potentially compromising the entire system and sensitive patron or library data.
Technical details
The vulnerability is a code injection flaw in Koha's web service (listening on TCP port 8081 by default) that stems from insufficient input validation before passing user-supplied strings to the eval function. An attacker with valid authentication credentials can inject arbitrary code that will be executed in the context of the service account, achieving remote code execution. The attack requires authentication but has no other preconditions; an attacker can leverage this to fully compromise the affected Koha installation. Fixed versions are 26.11.00, 26.05.02, 25.11.07, 25.05.13, and 24.11.18.
Affected products
- Koha Koha before 24.11.18, 25.05.13, 25.11.07, 26.05.02, and 26.11.00
Timeline
- 2026-04-07: disclosed: Vulnerability reported to vendor
- 2026-09-08: advisory: Coordinated public release of advisory
- 2026-09-08: patched: Fixed versions released: 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18