Koha Eval Code Injection Remote Code Execution Vulnerability

September 8th, 2026
ZDI-26-616 ZDI-CAN-29165

CVE ID

CVE-2026-19780

CVSS Score

8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Koha

Affected Products

Koha

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account.

Additional Details

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233
Fixed in versions: 26.11.00,26.05.02,25.11.07,25.05.13,24.11.18


Disclosure Timeline

  • 2026-04-07 - Vulnerability reported to vendor
  • 2026-09-08 - Coordinated public release of advisory
  • 2026-09-08 - Advisory Updated

Credit

Shukrulloh Raximov

Back to Advisories