ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19780, a CVSS 8.8 authenticated eval code-injection flaw in Koha enabling remote code execution.
Zero Day Initiative advisory ZDI-26-616 describes a code injection vulnerability in the Eval component of Koha, the open-source integrated library system. A remote attacker must authenticate before injecting and executing arbitrary code on affected installations. ZDI assigned the flaw a CVSS 3.0 rating of 8.8.
35