What is the CVSS score of CVE-2026-70370?

CVE-2026-70370 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Koha are affected by CVE-2026-70370?

Koha library management systems prior to versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01 contain a SQL injection vulnerability in the reports module that permits authenticated staff users to…. A patch is available.

How to fix or mitigate CVE-2026-70370?

Within 24 hours, audit current Koha versions across all systems and restrict reports module access to staff with documented business need. Within 7 days, apply vendor-released patches: upgrade 24.x systems to 24.11.17 or later, 25.05.x to 25.05.12 or later, 25.11.x to 25.11.06 or later, and 26.05.x to 26.05.01 or later. Within 30 days, verify all patches are deployed, audit access logs for suspicious report module activity, and assess whether staff access permissions can be further restricted.

Koha CVE-2026-70370

EUVD-2026-52672 HIGH

SQL Injection (CWE-89)

2026-08-04 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-8rx2-c3qm-2mc4

SQLi

8.8

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L confirmed by explicit staff-account-plus-reports-permission requirement; AV:N as a web endpoint; C/I/A:H because unrestricted SQL execution exposes full database read and potential write within the Koha DB user's scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 13:50 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 13:37 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 13:37 NVD

MEDIUM HIGH

CVSS changed

Aug 05, 2026 - 13:37 NVD

6.5 (MEDIUM) 8.8 (HIGH)

Analysis Generated

Aug 04, 2026 - 18:29 vuln.today

Patch available

Aug 04, 2026 - 14:16 EUVD

CVE Published

Aug 04, 2026 - 13:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

AnalysisAI

SQL injection in Koha's reports/catalogue_stats.pl allows an authenticated staff user with the reports module permission to read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. Affected releases span all Koha branches prior to 24.11.17, 25.05.12, 25.11.06, and 26.05.01, with vendor-released fixes now available. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the SSVC framework rates exploitation status as none and automatable as no, reflecting the authenticated staff-account prerequisite.

Technical ContextAI

Koha is a widely deployed open-source Integrated Library System (ILS) written in Perl, used by public, academic, and special libraries globally. The vulnerable code path is in reports/catalogue_stats.pl within the calculate subroutine, which constructs dynamic SQL by interpolating the HTTP request parameters Line and Column directly into SQL identifier positions - specifically SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses - without whitelist validation against a permitted set of column names. A secondary injection surface activates when Line equals 'itemcallnumber' and the cotedigits parameter is truthy: cotedigits is concatenated raw as the numeric argument of a SQL LEFT() function call. CWE-89 (Improper Neutralization of Special Elements in an SQL Command) applies precisely: because user input lands at structural identifier positions rather than value positions, standard parameterized query binding would not alone prevent exploitation - the fix must also validate identifier values against a whitelist of permitted column names.

RemediationAI

Upgrade to the first fixed release on your installed branch: Koha 24.11.17, 25.05.12, 25.11.06, or 26.05.01 as appropriate. Release packages are available at https://download.koha-community.org/koha-25.05.12.tar.gz and the community release announcement at https://koha-community.org/koha-25-05-12-released/; consult the Koha bug tracker entry at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 for branch-specific patch details. If immediate patching is not feasible, audit and remove the reports module permission from all staff accounts that do not operationally require it - note this will disrupt legitimate reporting workflows for affected staff. As a secondary compensating control, restrict network access to reports/catalogue_stats.pl at the reverse proxy or web server layer for IP ranges outside trusted library networks, accepting reduced remote reporting capability. Database-level read restrictions on the borrowers, api_keys, and sessions tables for the Koha database user could limit blast radius but risk breaking core Koha functionality and require thorough regression testing before deployment.