CVE-2026-70371

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70371
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70371.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70371
Published
2026-08-04T13:00:10.726Z
Modified
2026-08-07T03:30:35.604183017Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Koha: SQL Injection in reports/issues_avg_stats.pl
Details

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "25.05.00"
                },
                {
                    "fixed": "25.05.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70371.json",
    "cna_assigner": "TuranSec",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / gitlab.com/koha-community/Koha

Affected ranges

Type
GIT
Repo
https://gitlab.com/koha-community/Koha
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
926655c0a86da8f2255bfbaa0983a7b120a83bef
Introduced
3f2987eb19f7ac1987591d8e9b01961c39405b39
Fixed
ed96c9f656546909ce4c52b5eba2e74ab6e3b7e6
Introduced
e4bb3afa5bc1a9951438c1963b12a27b5d16980c
Fixed
dacce7d3fc15860d26d06444c1f5c9a2d0d6a4a9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.11.17"
        },
        {
            "introduced": "25.11.00"
        },
        {
            "fixed": "25.11.06"
        },
        {
            "introduced": "26.05.00"
        },
        {
            "fixed": "26.05.01"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
R_1-2-2RC4
R_1-3-0
R_1-3-1
R_1-3-2
R_1-3-3
R_1-9-0
R_1-9-1
R_1-9-2
R_1-9-3
R_2-0-0RC1
R_2-0-0pre1
R_2-0-0pre2
R_2-0-0pre3
R_2-0-0pre4
R_2-0-0pre5
R_2-1
R_2-4
v16.*
v16.05.00
v16.05.00-beta
v16.11.00
v17.*
v17.05.00
v17.11.00
v18.*
v18.05.00
v18.05.00-rc1
v18.11.00
v19.*
v19.05.00
v19.11.00
v20.*
v20.05.00
v20.11.00
v21.*
v21.05.00
v21.11.00
v22.*
v22.05.00
v22.11.00
v23.*
v23.05.00
v23.11.00
v24.*
v24.05.00
v24.11.00
v24.11.01
v24.11.02-1
v24.11.03-2
v24.11.03-3
v24.11.04-1
v24.11.05-1
v24.11.06-1
v24.11.07-1
v24.11.08-1
v24.11.08-2
v24.11.08-3
v24.11.09-1
v24.11.10-2
v24.11.11-1
v24.11.11-2
v24.11.12-1
v24.11.13-1
v24.11.14-1
v24.11.16-2
v25.*
v25.11.00
v25.11.00-1
v25.11.00-2
v25.11.01-1
v25.11.01-2
v25.11.02-1
v25.11.03-1
v25.11.03-2
v25.11.04-1
v25.11.05-1
v26.*
v26.05.00
v3.*
v3.00.00
v3.00.00-alpha
v3.00.00-beta
v3.00.00-beta2
v3.00.00-stableRC1
v3.02.00-alpha
v3.02.00-alpha2
v3.02.00-beta
v3.04.00
v3.08.00
v3.12.00-alpha
v3.12.00-alpha2
v3.12.00-beta1
v3.14.00-alpha1
v3.14.00-alpha2
v3.14.00-beta
v3.16.00
v3.16.00-beta
v3.16.00-rc
v3.18.00
v3.18.00-beta
v3.20.00
v3.20.00-beta
v3.22.00
v3.22.00-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70371.json"