Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirname/;" in upload-cover-image.pl is vulnerable to command injection via shell metacharacters because input data can be controlled by an attacker and is directly included in a system command, i.e., an attack can occur via malicious filenames after uploading a .zip file and clicking Process Images.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2024-36057 Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirn… https://www.cve.org/CVERecord?id=CVE-2024-36057
Post summary
The text announces CVE-2024-36057, a remote code execution flaw in Koha Library caused by unsanitized filenames during unzipping, without mentioning PoC, patch, or active exploitation.
CVE-2024-36057 Remote Code Execution in Koha Library Before 23.05.10 via... https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-36057 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE‑2024‑36057, a remote code execution flaw in Koha Library up to version 23.05.10, providing a link for more details but no PoC, exploit code, or patch information.