CVE-2024-36057

OVERVIEW CVE-2024-36057 is a command injection vulnerability in Koha Library versions prior to 23.05.10 that stems from inadequate sanitization of user-supplied filenames in the upload-cover-image.pl script. The vulnerability allows attackers to execute arbitrary commands through maliciously crafted .zip filenames that are processed by an unsanitized unzip command. SEVERITY This vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and impacts all three security dimensions: confidentiality, integrity, and availability. An unauthenticated remote attacker can achieve complete system compromise by uploading a zip file with shell metacharacters in the filename and triggering the "Process Images" function. EXPLOITATION STATUS There is no indication of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on community hotlists. While the EPSS score of 0.00145 suggests relatively lower likelihood of exploitation compared to other vulnerabilities, the critical severity and straightforward attack mechanism warrant immediate patching of affected Koha installations.