CVE-2026-70373 Details
Description
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
A SQL injection vulnerability has been identified in Koha's reports/issues_stats.pl file, specifically within the circulation statistics report. The vulnerability arises because the report generates its SQL query by directly concatenating user-controlled parameters into the SQL string without proper validation or escaping. This issue allows an authenticated staff user with reports module permission to inject arbitrary SQL and access any database table available to the Koha database user, including sensitive information such as password hashes, two-factor authentication secrets, personal data, API keys, and session information.
Users can update to Koha versions 26.11.00, 26.05.01, 25.11.06, or 25.05.12, all of which include the necessary fix. Instructions for downloading Koha are available on the Koha Community website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 | TuranSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://download.koha-community.org/koha-25.05.12.tar.gz | TuranSec | Broken LinkVendor |
| https://koha-community.org/koha-25-05-12-released/ | TuranSec | AdvisoryBundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Koha | >= 25.12, < 25.12.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | TuranSec |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | TuranSec |