CVE-2026-105107
Deferred Deferred - Pending Action

SQL Injection in Koha Library Software

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: TuranSec

Description
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-105107
EUVD
EUVD-2026-100898

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Koha Community Koha 0
Koha Community Koha 24.11.00
Koha Community Koha 25.05.00
Koha Community Koha 25.11.00
Koha Community Koha 26.05.00

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script concatenates user-controlled Criteria, Filter, and Limit parameters directly into dynamic SQL without proper validation. Criteria is inserted verbatim into SQL clauses like SELECT, GROUP BY, and ORDER BY. Filter values are concatenated raw into LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with reports module permission can inject arbitrary SQL and read any table accessible by the Koha database user.

Detection Guidance

Check Koha version against patched releases (24.11.19, 25.05.14, 25.11.08, 26.05.03, or 26.11 dev branch). Review web server access logs for suspicious requests to /reports/cat_issues_top.pl with unusual parameters like Criteria, Filter, or Limit containing SQL keywords (UNION, SELECT, DROP, etc.).

Use database query logs to detect unauthorized data access or modifications. Monitor for unexpected database user activity, especially from the Koha application user.

Impact Analysis

An attacker with staff access can exploit this to read sensitive data such as borrower passwords, two-factor secrets, personal information, API keys, and session data. This could lead to unauthorized access, data breaches, or further system compromise. The vulnerability requires only basic staff permissions, not superuser access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches exposing sensitive borrower information, leading to regulatory fines, reputational damage, and legal consequences for non-compliance.

Mitigation Strategies

Upgrade Koha to a patched version immediately (24.11.19, 25.05.14, 25.11.08, 26.05.03, or 26.11 dev branch). If immediate upgrade is not possible, restrict access to the reports module to trusted staff users only.

Temporarily disable the Most-circulated items report feature by removing or restricting access to /reports/cat_issues_top.pl until patched. Review database user permissions to limit potential data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart