What’s Vulnerable › Vulnerabilities

CVE-2026-70373: Koha - SQL Injection in reports/issues_stats.pl

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-04 · updated 2026-10-23
• Weakness: CWE-89

Description

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Affected products

• Koha Community Koha: through 24.11.17; from 25.05.00 through 25.05.12; from 25.11.00 through 25.11.06; from 26.05.00 through 26.05.01

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735
• https://download.koha-community.org/koha-25.05.12.tar.gz
• https://koha-community.org/koha-25-05-12-released/

Get alerted when CVE-2026-70373 or the next vulnerability affects your stack