CVE-2026-6428

Koha before versions 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with borrowers => edit_borrowers permission can cause time-based denial of service by storing a SQL payload in a patron lang field, which executes when an issue slip is printed.

An SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with tools => label_creator permission can execute arbitrary SQL via the image_name field of a patron card layout, allowing reading the entire database including patron PII and staff bcrypt password hashes.

A stored SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The value is stored verbatim and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. The injection allows reading the entire Koha database including patron PII and staff bcrypt password hashes.

Koha's guided report builder reads CGI parameters and concatenates them directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared statements, an explicit allowlist is required but missing.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Vulnerability in Koha's reports/catalogue_stats.pl where dynamic SQL is built by interpolating user-controlled Line and Column parameters directly into identifier positions of the query without whitelist validation.