ZDI 26 616

www.zerodayinitiative.com • September 10, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account.

Fixed in versions: 26.11.00,26.05.02,25.11.07,25.05.13,24.11.18

2026-04-07 - Vulnerability reported to vendor

2026-09-08 - Coordinated public release of advisory

2026-09-08 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Koha Remote Code Execution Vulnerability Disclosed A remote code execution vulnerability has been identified in Koha, affecting installations that allow remote attackers to execute arbitrary code. The flaw requires authentication and exists within the web service listening on TCP port 8081. It stems from improper validation of user-supplied strings passed to the eval function, enabling attackers to execute code in the context of the service account. The vulnerability has been assigned the identifier ZDI-26-616 and is fixed in versions 26.11.00, 26.05.02, 25.11.07, 25.05.13, and 24.11.18. The vulnerability was reported to the vendor on April 7, 2026, and a coordinated public release of the advisory occurred on September 8, 2026. The advisory was updated the same day. 2 sources 46

Extracted Entities

ZDI 26 616

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)