CVE-2026-70372 Details
Description
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
A SQL injection vulnerability has been identified in Koha's reports module, specifically in the script 'reports/bor_issues_top.pl'. This issue arises from the script's 'calculate' subroutine, which constructs dynamic SQL queries by directly concatenating user-controlled parameters from the 'Filter' request. The 'Criteria' parameter is only partially sanitized, allowing for unvalidated input to be injected into critical SQL query positions. An authenticated staff user with reports module permission can exploit this vulnerability to execute arbitrary SQL commands and access any database table available to the Koha database user, including sensitive information such as borrower data, password hashes, two-factor authentication secrets, API keys, and session information.
Users can upgrade to Koha versions 26.11.00, 25.11.06, 25.05.12, or 24.11.17, all of which include the necessary patch to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 | TuranSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://download.koha-community.org/koha-25.05.12.tar.gz | TuranSec | Broken LinkVendor |
| https://koha-community.org/koha-25-05-12-released/ | TuranSec | AdvisoryBundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Koha | 25.12.00.042 25.11.03.001 25.05.08.000 24.11.14.000 23.11.15.000 22.11.35.000 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | TuranSec |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | TuranSec |