EUVD-2026-34169
GHSA-j9m8-fw2w-frcq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features
AnalysisAI
Stored Cross-Site Scripting in Koha 25.11 and earlier allows a remote authenticated attacker to inject and execute arbitrary JavaScript in victim browsers via the file upload function within the Invoice features module. The CVSS Scope:Changed designation indicates the injected script executes in a security context beyond the attacker's own session - targeting higher-privileged users (e.g., acquisitions staff or administrators) who subsequently view the affected invoice. A researcher blog post at g03m0n.github.io documents this vulnerability, suggesting public technical details are available. No public exploit identified at time of analysis, and EPSS at 0.05% (16th percentile) indicates low observed exploitation probability.
Technical ContextAI
Koha is an open-source Integrated Library System (ILS) widely deployed by public, academic, and special libraries. The Invoice feature is part of Koha's acquisitions module, used to manage financial records and file attachments associated with vendor orders. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause is insufficient sanitization or encoding of user-supplied content - in this case, a filename or file content submitted via the upload function - before it is rendered back in the browser. The Scope:Changed (S:C) attribute in the CVSS vector confirms this is a stored or reflected XSS that crosses privilege boundaries: a lower-privileged user submits malicious input that is later rendered in the session of a higher-privileged user. The CPE data provided is unpopulated (n/a), so affected product enumeration relies solely on the CVE description. Note: the 'RCE' tag associated with this CVE refers to client-side JavaScript execution in the victim's browser context, not server-side remote code execution - the CVSS score of 5.4 and CWE-79 confirm this is browser-level code execution.
RemediationAI
Upgrade to a patched release of Koha beyond version 25.11; as of this analysis, an exact fixed release version has not been independently confirmed from the available reference data - monitor the official Koha release page at https://github.com/Koha-Community/Koha and the Koha community mailing lists for a tagged patch release. Until a patch is applied, restrict access to the acquisitions and invoice module to the minimum set of trusted accounts, removing or disabling upload permissions for any untrusted vendor or low-privileged user accounts - this directly removes the attacker's injection vector but may disrupt normal acquisitions workflows. Deploying a Web Application Firewall (WAF) rule to inspect and block file upload requests containing HTML/JavaScript content to the invoice endpoint is an additional compensating control, though WAF bypass via encoding is a known risk. Monitoring for unexpected script execution in library staff browser sessions can serve as a detection measure.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today