CVE-2014-1922: Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3...

Security readout for executives and security teams

Older Koha library management systems included a path traversal flaw that could let a remote attacker read files from the server. The sources do not give a CVSS score or confirm exploitation, but arbitrary file read can expose credentials, configuration, or patron-related data if vulnerable systems remain online. Exposure is most likely in internet-facing or partner-accessible Koha deployments running the listed legacy versions. Modern supported Koha versions are unlikely to be affected, but old library systems may persist in long-lived environments. Prioritize remediation for any externally reachable Koha instance handling sensitive library, user, or configuration data. The vulnerability is old, but old public systems create outsized risk when unsupported software remains exposed. Mitigation focus: Upgrade Koha to the fixed branch version or a later supported release.; Review the February 2014 Koha security release guidance.; Restrict untrusted access to vulnerable Koha interfaces until patched..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.