CVE-2026-71288
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Koha's guided report builder reads CGI parameters and concatenates them directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared statements, an explicit allowlist is required but missing.
Risk Assessment
An authenticated user could inject SQL code, potentially leading to unauthorized data access or modification of the database.
Recommendation
Apply the vendor's patch or manually add an allowlist of permitted column names for ORDER BY parameters in the report builder.
Other vulnerabilities in Koha
See all- CVE-2026-41921Medium
Koha before versions 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.
- CVE-2026-72610Medium
Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with borrowers => edit_borrowers permission can cause time-based denial of service by storing a SQL payload in a patron lang field, which executes when an issue slip is printed.
- CVE-2026-72609High
An SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.
- CVE-2026-72608Medium
Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with tools => label_creator permission can execute arbitrary SQL via the image_name field of a patron card layout, allowing reading the entire database including patron PII and staff bcrypt password hashes.
- CVE-2026-72607High
A stored SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The value is stored verbatim and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. The injection allows reading the entire Koha database including patron PII and staff bcrypt password hashes.
- CVE-2026-70373High
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
- CVE-2026-70372High
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
- CVE-2026-70371High
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
- CVE-2026-70370High
Vulnerability in Koha's reports/catalogue_stats.pl where dynamic SQL is built by interpolating user-controlled Line and Column parameters directly into identifier positions of the query without whitelist validation.
- CVE-2026-70369High
Vulnerability in Koha's reports/acquisitions_stats.pl where the per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE fragments covering multiple fields.
Original NVD description (English source)
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.