PT-2026-30839 · Unknown · Koha Library

Published 2026-04-07 · Updated 2026-04-07 · CVE-2024-36057

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Koha Library versions prior to 23.05.10

Description Koha Library versions before 23.05.10 do not properly sanitize filenames provided by users before unzipping them, which can lead to remote code execution. The upload-cover-image.pl script contains a command injection issue in the line 'qx/unzip $filename -d $dirname/;' due to the direct inclusion of attacker-controlled input within a system command. This can be triggered by uploading a malicious .zip file and then clicking Process Images.

Recommendations Update to version 23.05.10 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-36057

Affected Products

Koha Library

References · 6

• 🔥 https://github.com/hacklantic/Research/tree/main/CVE-2024-36057 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36057 · Security Note
• https://gitlab.com/koha-community/Koha/-/blob/23.05.x/misc/release_notes/release_notes_23_05_11.md · Note
• https://koha-community.org/koha-22-05-22-released · Note
• https://twitter.com/VulmonFeeds/status/2041650289955000430 · Twitter Post
• https://gitlab.com/koha-community/Koha/-/blob/23.05.x/misc/release_notes/release_notes_23_05_10.md · Note