https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|[ZDI-CAN-29165] Remote code |[CVE-2026-19780][ZDI-CAN-29 |execution in user-supplied |165] Remote code execution |regex |in user-supplied regex --- Comment #158 from David Cook <dcook@prosentient.com.au> --- (In reply to ZDI Disclosures Trendmicro from comment #157)

Hello,

Please find the following assigned CVE: CVE-2026-19780. Would you please provide us with the fix link?

Thanks, ZDI

Thanks for sharing that. I don't know what we'd use for a fix link per se, since the fix is spread across a number of patches listed in the Attachments section, but you can link to https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233 and mention the fix is included in these versions (found above in "Version(s) released in:"): 26.11.00,26.05.02,25.11.07,25.05.13,24.11.18 Does that work for you? Thanks again for your work on this one! -- You are receiving this mail because: You are watching all bug changes.