Koha EUVD-2026-100897

Requires an authenticated Koha staff account holding the specific tools => schedule_tasks permission; the attacker must reach the tools/scheduler.pl handler and issue an op=cud-delete request supplying shell metacharacters in the jobid parameter. This is NOT exploitable against a default anonymous or low-privileged session - the schedule_tasks permission is a deliberately granted staff capability, which is the primary limiting factor. No user interaction by a victim is needed (UI:N), and no non-default server configuration is required beyond the Task Scheduler feature being present; exploitation runs with the privileges of the Koha web/application OS user, so impact is bounded by that account's OS permissions.

This is a genuine, high-priority post-authentication vulnerability but not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a network-reachable handler, low attack complexity, and full confidentiality/integrity/availability loss via arbitrary OS command execution. The key risk-limiting signal is PR:L - exploitation is NOT unauthenticated; it requires a valid staff account holding the specific tools => schedule_tasks permission, which materially narrows the attacker population to insiders or anyone who has already compromised a sufficiently-privileged staff session. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no evidence of active exploitation or public exploit code; the CWE-78 pattern is trivially understood, but absence of these signals means this should be treated as 'patch promptly' rather than 'under active attack.' No CVSS/description conflict is present - both agree the vector is network-delivered but privileged. Overall: a real, straightforwardly weaponizable RCE once a schedule_tasks account is in hand, tempered by the authentication and permission precondition.

An authenticated Koha staff user (or an attacker who has phished/hijacked such a session) who holds the tools => schedule_tasks permission submits an op=cud-delete request to tools/scheduler.pl with shell metacharacters embedded in the jobid parameter. Because the value is interpolated unquoted into an atrm command run through system() in a shell, the injected payload executes as the Koha web/application user, yielding arbitrary command execution. No public exploit code was identified at time of analysis, but the flaw is trivial to trigger for anyone with the required permission.