What’s Vulnerable › Vulnerabilities

CVE-2026-31844: Authenticated SQL Injection in Koha displayby parameter of suggestion.pl

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-08-10
• Weakness: CWE-89

Description

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Affected products

• Koha Community Koha: from 24.11.0 before 24.11.12; from 25.05.0 before 25.05.07; 25.11.00 — fixed in 24.11.12, 25.05.07

How to fix

Upgrade to a fixed version: Koha Community Koha 24.11.12, 25.05.07. Check the vendor advisory for mitigations.

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593
• https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/
• https://koha-community.org/koha-25-11-01-released/

Get alerted when CVE-2026-31844 or the next vulnerability affects your stack