CVE-2025-30076

State: Published
Severity: 7.7 High
Published: Mar 16, 2025
Updated: Mar 17, 2025
Reserved: Mar 16, 2025

Description

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N	mitre

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
KohaKoha	before 22.11.24Affected 23 to before 23.11.12Affected 24 to before 24.05.07Affected 24.06 to before 24.11.02Affected

References

https://github.com/gl0wyy/koha-task-scheduler-rce
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.