SQL Injection Vulnerability in Koha's Circulation Statistics Report

CVE-2026-70373

What is CVE-2026-70373?

In Koha's circulation statistics report, user-controlled input parameters are directly concatenated into an SQL string without proper sanitization. This oversight allows authenticated users with permission to the reports module to inject arbitrary SQL queries. As a result, attackers can access sensitive information from any table within the Koha database, including borrowers' personal data, passwords, and API keys. This vulnerability highlights the critical need for secure coding practices to prevent unauthorized data exposure in library management systems.

References