Initiated by an authenticated staff user, the attacker supplies a crafted jobid value to the tools/scheduler.pl handler during a scheduled‑task deletion. The kernel of the flaw lies in the C4::Scheduler::remove_at_job routine, which substitutes the jobid directly into an atrm command string without quoting or escaping. This command is then executed via a single‑argument system() call, which spawns a shell. The result is that arbitrary operating‑system commands run with the privileges of the Koha web/application user. The weakness is a classic OS command injection (CWE‑78), exposing the system to complete compromise.

Affected products are the Koha Community edition. Any installation using versions older than the releases that contain the fix – notably prior to 24.11.20, 25.05.15, 25.11.09, 26.05.04, or the current 26.11 development branch – is vulnerable. These releases are identified as Koha 24, 25, and 26 series with the listed patch versions.

The scoring reflects a high severity: a CVSS of 8.8 indicates a critical confidence that attackers can execute code if they have at least staff authentication and the schedule_tasks permission. An EPSS of 2% suggests that, while the vulnerability is not extremely common, there is a measurable risk of exploitation. The vulnerability is not yet documented in CISA’s KEV catalog, but any exposed Koha instance that grants the relevant permission is a valid target. The attacker needs to authenticate via the web interface and submit the carefully crafted jobid parameter; no remote code execution without that privilege level is indicated.