CVE-2026-31844

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31844
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31844.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31844
Published
2026-03-11T06:34:14.869Z
Modified
2026-07-15T02:18:55.395098639Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
Details

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and exposure of sensitive database information. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31844.json",
    "cna_assigner": "TuranSec",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "24.11.0"
                },
                {
                    "fixed": "24.11.12"
                },
                {
                    "introduced": "25.05.0"
                },
                {
                    "fixed": "25.05.07"
                },
                {
                    "introduced": "25.11.0"
                },
                {
                    "fixed": "25.11.01"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/koha-community/koha

Affected ranges

Type
GIT
Repo
https://github.com/koha-community/koha
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5b7a05b4dbd9219a33eaa709103189f93163bf97
Fixed
87a3a54768a2b324fdc0c16b5623d092fac7652a
Introduced
3f2987eb19f7ac1987591d8e9b01961c39405b39
Last affected
3f2987eb19f7ac1987591d8e9b01961c39405b39
Database specific 
{
    "cpe": [
        "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:koha:koha:25.11.00:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "24.11.0"
        },
        {
            "fixed": "24.11.12"
        },
        {
            "introduced": "25.05.0"
        },
        {
            "fixed": "25.05.07"
        },
        {
            "introduced": "25.11.00"
        },
        {
            "last_affected": "25.11.00"
        }
    ]
}

Affected versions

25.*
25.11.00
Other
R_1-2-2RC4
R_1-3-0
R_1-3-1
R_1-3-2
R_1-3-3
R_1-9-0
R_1-9-1
R_1-9-2
R_1-9-3
R_2-0-0RC1
R_2-0-0pre1
R_2-0-0pre2
R_2-0-0pre3
R_2-0-0pre4
R_2-0-0pre5
R_2-1
R_2-4
v16.*
v16.05.00
v16.05.00-beta
v16.11.00
v17.*
v17.05.00
v17.11.00
v18.*
v18.05.00
v18.05.00-rc1
v18.11.00
v19.*
v19.05.00
v19.11.00
v20.*
v20.05.00
v20.11.00
v21.*
v21.05.00
v21.11.00
v22.*
v22.05.00
v22.11.00
v23.*
v23.05.00
v23.11.00
v24.*
v24.05.00
v24.11.00
v24.11.01
v24.11.02-1
v24.11.03-2
v24.11.03-3
v24.11.04-1
v24.11.05-1
v24.11.06-1
v24.11.07-1
v24.11.08-1
v24.11.08-2
v24.11.08-3
v24.11.09-1
v24.11.10-2
v24.11.11-1
v24.11.11-2
v25.*
v25.05.00-1
v25.05.01-1
v25.05.02-1
v25.05.02-2
v25.05.03-1
v25.05.04-1
v25.05.05-1
v25.05.05-2
v25.05.06-2
v25.11.00
v3.*
v3.00.00
v3.00.00-alpha
v3.00.00-beta
v3.00.00-beta2
v3.00.00-stableRC1
v3.02.00-alpha
v3.02.00-alpha2
v3.02.00-beta
v3.04.00
v3.08.00
v3.12.00-alpha
v3.12.00-alpha2
v3.12.00-beta1
v3.14.00-alpha1
v3.14.00-alpha2
v3.14.00-beta
v3.16.00
v3.16.00-beta
v3.16.00-rc
v3.18.00
v3.18.00-beta
v3.20.00
v3.20.00-beta
v3.22.00
v3.22.00-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31844.json"