# CVE-2026-19780: Koha eval code injection remote code execution

Source: https://junglewise.ai/threats/cve-2026-19780-koha-eval-code-injection-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19780 · Severity: high · CVSS 8.8 · Published 2026-09-15

Koha is a popular open-source library management system used by institutions worldwide to manage book catalogs, patron records, and circulation operations. This vulnerability allows authenticated users to execute arbitrary code on the server by injecting malicious input into an unvalidated parameter processed by the eval function, potentially compromising the entire system and sensitive patron or library data.

## Quick answers

**Is CVE-2026-19780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19780 being exploited in the wild.

**How severe is CVE-2026-19780?** High severity, with a CVSS score of 8.8, published 15 September 2026.

**Which products and versions are affected?** Koha Koha before 24.11.18, 25.05.13, 25.11.07, 26.05.02, and 26.11.00.

**Is there a fix for CVE-2026-19780?** A patch was published on 2026-09-08: Fixed versions released: 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19780 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-19780?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw in Koha's web service (listening on TCP port 8081 by default) that stems from insufficient input validation before passing user-supplied strings to the eval function. An attacker with valid authentication credentials can inject arbitrary code that will be executed in the context of the service account, achieving remote code execution. The attack requires authentication but has no other preconditions; an attacker can leverage this to fully compromise the affected Koha installation. Fixed versions are 26.11.00, 26.05.02, 25.11.07, 25.05.13, and 24.11.18.

## Affected products

- Koha Koha before 24.11.18, 25.05.13, 25.11.07, 26.05.02, and 26.11.00

## Timeline

- 2026-04-07: disclosed: Vulnerability reported to vendor
- 2026-09-08: advisory: Coordinated public release of advisory
- 2026-09-08: patched: Fixed versions released: 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-616/](https://www.zerodayinitiative.com/advisories/ZDI-26-616/)