CVE-2026-70372: Koha - SQL Injection in reports/bor_issues_top.pl

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-10-23
Weakness: CWE-89

Description

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Affected products

Koha Community Koha: through 24.11.17; from 25.05.00 through 25.05.12; from 25.11.00 through 25.11.06; from 26.05.00 through 26.05.01

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369
https://download.koha-community.org/koha-25.05.12.tar.gz
https://koha-community.org/koha-25-05-12-released/

Get alerted when CVE-2026-70372 or the next vulnerability affects your stack