ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability

Koha, an open-source integrated library system, contains a code injection flaw (CWE-95) in a web service that listens on TCP port 8081 by default: a user-supplied string is passed to the eval function without proper validation. A remote attacker with valid authentication credentials can submit a crafted string to this service and execute arbitrary code in the context of the service account. Successful exploitation gives full compromise of confidentiality, integrity, and availability on the Koha server (CVSS 3.0: 8.8, high). Organizations running affected Koha deployments are at risk, particularly where port 8081 is reachable from untrusted networks; however, the authentication requirement limits attacks to holders of valid credentials. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not on the CISA KEV list.

Do: Apply the vendor patch specified in ZDI-26-616 (upgrade to the latest fixed Koha release). Restrict TCP 8081 at the firewall so the web service is reachable only from trusted staff/consortium networks, audit service accounts for weak or shared credentials, and review logs for unexpected code execution or anomalous activity under the service account.