CVE-2026-105107 Details
Description
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).
A SQL injection vulnerability has been identified in the Koha library management system, specifically within the 'Most-circulated items' report feature. This issue affects Koha versions through 22.11.38, 23.05.00 through 23.11.15, 24.05.00 through 24.11.16, 25.05.00 through 25.05.11, 25.11.00 through 25.11.05, 26.05.00 through 26.05.01, and 26.11.x prior to 26.11.00. The vulnerability arises in the reports/cat_issues_top.pl script, where user-controlled parameters are directly concatenated into SQL queries without proper validation or sanitization. This allows authenticated staff users with reports permissions to inject arbitrary SQL and access sensitive data from the Koha database, including personal information and hashed passwords of borrowers.
Users can update to Koha versions 24.11.19, 25.05.14, 25.11.08, or 26.05.03. Instructions for downloading Koha can be found on the Koha Community website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42736 | TuranSec | ExploitIssue TrackingTechnical AnalysisVendor |
| https://download.koha-community.org/ | TuranSec | ProductVendor |
| https://www.cve.org/CVERecord?id=CVE-2026-6428 | TuranSec | Not Applicable |
| https://www.cve.org/CVERecord?id=CVE-2026-70372 | TuranSec | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Koha | >= 25.12, < 26.11.00 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | TuranSec |