CVE-2025-30076

Description

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.

Affected Platforms

Weakness Type

CWE-78

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170
• https://github.com/gl0wyy/koha-task-scheduler-rce
• https://github.com/gl0wyy/koha-task-scheduler-rce