CVE-2026-70371
Koha - SQL Injection in reports/issues_avg_stats.pl
- State
- Published
- Severity
- 8.8 High
- Published
- Aug 4, 2026
- Updated
- Aug 10, 2026
- Reserved
- Aug 4, 2026
Description
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | TuranSec |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
KohaKoha Community |
|
References
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368third-party-advisory
- https://koha-community.org/koha-25-05-12-released/third-party-advisory
- https://download.koha-community.org/koha-25.05.12.tar.gzthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.