CVE-2024-24337: Koha

High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days.

CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.

Affected products

• Koha Koha: up to and including 23.05.05

Published 2024-02-12. Last modified 2026-06-17.