The vulnerability in Koha Library prior to version 23.05.10 involves improper sanitization of user-supplied filenames during the unzip operation in the upload-cover-image.pl script. Specifically, the command line invocation 'qx/unzip $filename -d $dirname/;' is vulnerable to command injection because the filename parameter can contain shell metacharacters controlled by an attacker. Exploitation requires uploading a crafted .zip file with malicious filenames and triggering the 'Process Images' function, which executes the vulnerable command, potentially allowing remote code execution on the server.

Successful exploitation of this vulnerability can lead to remote code execution on the affected system, allowing an attacker to execute arbitrary commands with the privileges of the application process. This can result in full system compromise, data theft, or further attacks within the network. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade Koha Library to version 23.05.10 or later once available. Until a patch is applied, avoid processing untrusted .zip files or disable the image processing functionality that triggers this vulnerability. Implement input validation and sanitization on filenames before unzipping to mitigate command injection risks.