Koha vulnerabilities
Published CVEs affecting Koha products: 8 record(s), with severity, exploitation and fixes.
CVE-2026-19780
High · 8.8
CWE-95 Sep 15, 2026
Koha Eval Code Injection Remote Code Execution Vulnerability
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165.
CVE-2026-50767
Medium · 5.4
CWE-79 Jun 26, 2026
Cross-site Scripting (XSS) in Koha
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field (checkinmsg).
CVE-2026-50766
Medium · 5.4
CWE-79 Jun 26, 2026
Cross-site Scripting (XSS) in Koha
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).
CVE-2026-50765
Medium · 6.1
CWE-79 Jun 26, 2026
Cross-site Scripting (XSS) in Koha
A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).
CVE-2026-26379
Medium · 6.5
CWE-918 Jun 3, 2026
Server-Side Request Forgery (SSRF) in Koha
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.
CVE-2026-26378
Medium · 5.4
CWE-79 Jun 3, 2026
Cross-site Scripting (XSS) in Koha
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features
CVE-2026-31844
High · 8.8
CWE-89 Mar 11, 2026
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
CVE-2026-26377
Medium · 5.4
CWE-79 Mar 5, 2026
Cross-site Scripting (XSS) in Koha
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.