CVE-2026-70370

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70370
Published
2026-08-04T13:00:07.967Z
Modified
2026-08-06T03:48:28.587231237Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Koha: SQL Injection in reports/catalogue_stats.pl
Details

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), apikeys, and sessions.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70370.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "25.05.00"
                },
                {
                    "fixed": "25.05.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "TuranSec",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / gitlab.com/koha-community/Koha

Affected ranges

Type
GIT
Repo
https://gitlab.com/koha-community/Koha
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
926655c0a86da8f2255bfbaa0983a7b120a83bef
Introduced
3f2987eb19f7ac1987591d8e9b01961c39405b39
Fixed
ed96c9f656546909ce4c52b5eba2e74ab6e3b7e6
Introduced
e4bb3afa5bc1a9951438c1963b12a27b5d16980c
Fixed
dacce7d3fc15860d26d06444c1f5c9a2d0d6a4a9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.11.17"
        },
        {
            "introduced": "25.11.00"
        },
        {
            "fixed": "25.11.06"
        },
        {
            "introduced": "26.05.00"
        },
        {
            "fixed": "26.05.01"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
R_1-2-2RC4
R_1-3-0
R_1-3-1
R_1-3-2
R_1-3-3
R_1-9-0
R_1-9-1
R_1-9-2
R_1-9-3
R_2-0-0RC1
R_2-0-0pre1
R_2-0-0pre2
R_2-0-0pre3
R_2-0-0pre4
R_2-0-0pre5
R_2-1
R_2-4
v16.*
v16.05.00
v16.05.00-beta
v16.11.00
v17.*
v17.05.00
v17.11.00
v18.*
v18.05.00
v18.05.00-rc1
v18.11.00
v19.*
v19.05.00
v19.11.00
v20.*
v20.05.00
v20.11.00
v21.*
v21.05.00
v21.11.00
v22.*
v22.05.00
v22.11.00
v23.*
v23.05.00
v23.11.00
v24.*
v24.05.00
v24.11.00
v24.11.01
v24.11.02-1
v24.11.03-2
v24.11.03-3
v24.11.04-1
v24.11.05-1
v24.11.06-1
v24.11.07-1
v24.11.08-1
v24.11.08-2
v24.11.08-3
v24.11.09-1
v24.11.10-2
v24.11.11-1
v24.11.11-2
v24.11.12-1
v24.11.13-1
v24.11.14-1
v24.11.16-2
v25.*
v25.11.00
v25.11.00-1
v25.11.00-2
v25.11.01-1
v25.11.01-2
v25.11.02-1
v25.11.03-1
v25.11.03-2
v25.11.04-1
v25.11.05-1
v26.*
v26.05.00
v3.*
v3.00.00
v3.00.00-alpha
v3.00.00-beta
v3.00.00-beta2
v3.00.00-stableRC1
v3.02.00-alpha
v3.02.00-alpha2
v3.02.00-beta
v3.04.00
v3.08.00
v3.12.00-alpha
v3.12.00-alpha2
v3.12.00-beta1
v3.14.00-alpha1
v3.14.00-alpha2
v3.14.00-beta
v3.16.00
v3.16.00-beta
v3.16.00-rc
v3.18.00
v3.18.00-beta
v3.20.00
v3.20.00-beta
v3.22.00
v3.22.00-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70370.json"