SQL Injection Vulnerability in Koha's Most-Circulated Items Report
CVE-2026-105107

7.2HIGH

Key Information:

Vendor

Koha Community

Status
Koha
Vendor
CVE Published:
14 October 2026

What is CVE-2026-105107?

The Koha Integrated Library System is susceptible to SQL injection through its Most-circulated items report, allowing an authenticated user with proper permissions to execute arbitrary SQL commands. The vulnerability arises from the improper handling of user-controlled input in the reports/cat_issues_top.pl script, leading to seamless injection of malicious SQL into the database. This can result in unauthorized access to sensitive information, including user personal data and hash passwords. Mitigations have been introduced in later versions, including fixes in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.

Affected Version(s)

Koha 0 < 24.11.00

Koha 24.11.00 < 24.11.19

Koha 25.05.00 < 25.05.14

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id...
issue-tracking
https://download.koha-community.org/
release-notes
https://www.cve.org/CVERecord?id=CVE-2026-70372
related

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanjar Tulkinov Anvar o'g'li
.