What is the CVSS score of CVE-2026-70373?

CVE-2026-70373 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Koha are affected by CVE-2026-70373?

A SQL injection vulnerability in Koha's circulation statistics module (CVE-2026-70373, CVSS 8.8) enables staff members with reports access to extract the entire Koha database, including patron…. A patch is available.

How to fix or mitigate CVE-2026-70373?

Within 24 hours, inventory all production Koha deployments and confirm current versions across all active release branches. Within 7 days, apply vendor-released patches to every production Koha instance. Within 30 days, rotate all staff passwords and API keys, audit circulation reports access logs for unauthorized database queries, and verify no patron data extraction occurred.

Koha CVE-2026-70373

EUVD-2026-52675 HIGH

SQL Injection (CWE-89)

2026-08-04 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-wr9w-fmv5-77gm

SQLi

8.8

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

PR:L reflects required authenticated staff account with reports permission; A:L as description confirms read impact, while write and DoS impact are plausible for SQL injection but not explicitly described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 13:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 13:37 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 13:37 NVD

MEDIUM HIGH

CVSS changed

Aug 05, 2026 - 13:37 NVD

6.5 (MEDIUM) 8.8 (HIGH)

Analysis Generated

Aug 04, 2026 - 18:27 vuln.today

Patch available

Aug 04, 2026 - 14:16 EUVD

CVE Published

Aug 04, 2026 - 13:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

AnalysisAI

SQL injection in Koha's circulation statistics report (reports/issues_stats.pl) exposes the entire Koha database to authenticated staff members holding the reports module permission. The vulnerability arises from direct string concatenation of at least six user-controlled HTTP parameters - PeriodTypeSel, PeriodDaySel, PeriodMonthSel, multiple Filter slots, and the Line and Column report-dimension identifiers - into raw SQL with no parameterized binding or whitelist validation, enabling extraction of the borrowers table (password hashes, two-factor TOTP secrets, personal data), api_keys, and active session tokens. No public exploit has been identified at time of analysis and SSVC rates exploitation as none, but vendor-released patches are available across all four active Koha release branches.

Technical ContextAI

Koha is a widely deployed open-source Integrated Library System (ILS) written primarily in Perl and used by public, academic, and special libraries worldwide. The vulnerable endpoint is reports/issues_stats.pl, specifically the calculate subroutine responsible for constructing the circulation statistics query. Six distinct user-supplied HTTP request parameters are interpolated directly into single-quoted SQL equality and function-comparison fragments with no input sanitization, whitelist enforcement, or use of DBI placeholder binding - a textbook instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) stemming from the legacy Perl pattern of query construction via string concatenation. Because the Koha application database user holds broad schema privileges, a successful injection can reach any table the account can query, including the highly sensitive borrowers, api_keys, and sessions tables. Affected version ranges are confirmed by ENISA EUVD-2026-52675 and the Koha community Bugzilla report at bug 42735.

RemediationAI

Upgrade to the vendor-released fixed version for your branch: Koha 25.05.12 (release announcement at https://koha-community.org/koha-25-05-12-released/ and tarball at https://download.koha-community.org/koha-25.05.12.tar.gz), Koha 24.11.17, Koha 25.11.06, or Koha 26.05.01. Patched versions for the 24.11, 25.11, and 26.05 branches are stated in EUVD-2026-52675 but independently verified release announcements are not present in the provided references - consult https://koha-community.org for branch-specific release notes. If immediate upgrade is not feasible, restrict the reports module permission to the absolute minimum set of trusted staff accounts, as this permission is the sole exploitation gate and is not required by all staff roles; removing it from general staff eliminates the attack surface entirely at the cost of losing access to the reports module. Disabling or access-controlling the reports/issues_stats.pl endpoint at the web server layer is a more aggressive alternative that removes functionality but fully blocks exploitation. Network-layer WAF rules targeting SQL metacharacters in the named parameters provide only partial mitigation given the number of injectable parameters and should not substitute for patching.