What is the CVSS score of CVE-2026-71288?

CVE-2026-71288 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Koha are affected by CVE-2026-71288?

Koha library management system contains a SQL injection vulnerability in its report builder that allows library staff to access patron personally identifiable information, borrowing history, and…

How to fix or mitigate CVE-2026-71288?

Within 24 hours: audit access logs for suspicious activity in the reports module (`reports/guided_reports.pl`) and restrict feature access to administrators only; disable the feature in the web server or Koha configuration if feasible. Within 7 days: enable database audit logging to detect exploitation attempts, review current staff permission assignments and restrict `create_reports` and `execute_reports` permissions to essential staff only, and assess staff awareness of this risk. Within 30 days: monitor Koha vendor security advisories for a patched release, plan upgrade feasibility including pre-production testing, and establish a timeline for deployment once a patch is available.

Koha CVE-2026-71288

EUVD-2026-53373 HIGH

SQL Injection (CWE-89)

2026-08-05 TuranSec

GHSA-q274-qf66-4hq6

SQLi Koha Koha Community

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web application requires only low-privilege staff authentication; full C/I/A reflects unrestricted database read/write via SQL injection with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:46 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.8

DescriptionCVE.org

Koha's guided report builder (reports/guided_reports.pl) reads the order_by CGI parameter and, for each value, a dynamically-named {order}_ovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " ORDER BY $order $value"; }. The resulting string is appended verbatim to the final query in C4::Reports::Guided ($query .= $orderby;) with no escaping. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. Any staff account with the low-privilege create_reports or execute_reports permission (commonly granted to non-admin library staff) can perform time-based blind SQL injection against the Koha database, which stores patron PII and staff/LDAP credentials.

AnalysisAI

SQL injection in Koha's guided report builder (reports/guided_reports.pl) allows any authenticated staff member holding the low-privilege create_reports or execute_reports permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The order_by and dynamically-named {order}_ovalue CGI parameters are concatenated verbatim into an ORDER BY clause by C4::Reports::Guided with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.

Technical ContextAI

Koha is the world's most widely deployed open-source integrated library system (ILS), used by thousands of public, academic, and special libraries. The vulnerability is rooted in CWE-89 (SQL Injection) and exists because reports/guided_reports.pl calls $input->multi_param('order_by') and $input->param($order . '_ovalue') and concatenates both directly into the ORDER BY string, which C4::Reports::Guided then appends verbatim to the final query ($query .= $orderby). SQL prepared-statement placeholders cannot bind column names or sort directions, so the only safe approach is an explicit server-side allowlist of permitted column identifiers - one that does not exist in this code path. The affected CPE is cpe:2.3:a:koha_community:koha:*:*:*:*:*:*:*:*, indicating all community releases are affected. The Koha database is a MySQL/MariaDB instance and supports time-based blind injection techniques (e.g., SLEEP(), BENCHMARK()), making credential and PII extraction feasible without triggering visible error messages.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor the Koha Community GitHub repository at https://github.com/Koha-Community/Koha for commits addressing the ORDER BY injection in reports/guided_reports.pl. The primary compensating control is to immediately audit and revoke the create_reports and execute_reports permissions from any staff account that does not have a strict operational need - this directly eliminates the attack surface for non-admin users, though it may disrupt legitimate reporting workflows. As a secondary control, place the Koha web interface behind a WAF with a ruleset targeting ORDER BY injection patterns (e.g., ModSecurity CRS rules for SQL injection); note that WAF bypass is feasible for skilled attackers and this is not a substitute for a code fix. Network-level restriction of the Koha staff interface to trusted internal IP ranges reduces exposure to external attackers but does not address insider threat. The correct permanent fix requires implementing an explicit server-side allowlist of permitted column names in reports/guided_reports.pl before any user-supplied order_by or _ovalue value is interpolated into the query string.