The Koha Library system fails to sanitize filenames provided by users before extracting ZIP archives. Consequently, the script upload‑cover‑image.pl executes the shell command qx/unzip $filename -d $dirname/; with the filename directly concatenated. An attacker can supply a crafted filename containing shell metacharacters, which are then executed by the underlying shell. This flaw is a form of code injection (CWE‑94) and enables remote code execution, allowing the attacker to run arbitrary commands with the web process's privileges. Confidentiality, integrity, and availability of the affected environment could be compromised as a result.

The vulnerability exists in Koha Library releases before version 23.05.10. The public release notes for 23.05.10 and later indicate that the issue has been addressed. Users operating with Koha 23.05.09 or earlier versions are exposed, while those running 23.05.10 or newer are not affected. No additional vendor or product name beyond Koha Library is cited.

The CVSS score of 9.8 marks this flaw as Critical. The EPSS score is below 1 %, suggesting low current exploitation activity, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely web‑based: an authenticated or unauthenticated user might upload a malicious ZIP file and trigger the Process Images action. Successful exploitation would give an attacker remote code execution on the server, with full authority to modify data, exfiltrate information, or extend the attack surface. Administrators should assess whether the upload functionality is exposed to untrusted users and understand that the risk hinges on whether they can trigger the vulnerable script.