CVE-2025-30076

HIGH

Koha <22.11.24, 23-23.11.12, 24-24.05.07, 24.06-24.11.02 - OS Command Injection via Scheduler

Title source: llm
STIX 2.1

Description

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.

References (2)

Core 2

Scores

CVSS v3 7.7
EPSS 0.0037
EPSS Percentile 29.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (4)
Koha/Koha < 22.11.24
Koha/Koha 23 - 23.11.12
Koha/Koha 24 - 24.05.07
Koha/Koha 24.06 - 24.11.02
Published Mar 16, 2025
Tracked Since Feb 18, 2026