CVE-2026-70373

Summary

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Affected Software

VendorProductVersion RangeStatus
Koha CommunityKoha0 <= 24.11.17affected
Koha CommunityKoha25.05.00 <= 25.05.12affected
Koha CommunityKoha25.11.00 <= 25.11.06affected
Koha CommunityKoha26.05.00 <= 26.05.01affected

Weaknesses

  • CWE-89: CWE-89 SQL Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References