CVE-2026-26377
Cross-Site Scripting in Koha News Function Enables Remote Code Execution
Publication date: 2026-03-05
Last updated on: 2026-03-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| koha | koha | to 25.11.00 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26377 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting Koha versions up to and including 25.11.
This vulnerability requires authentication to exploit and involves an attacker injecting malicious scripts via the News function that are persistently stored on the server.
When other users view the stored malicious content, the script executes in their browsers without requiring social engineering.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability allows attackers to exfiltrate sensitive data and impersonate high-privileged users, including administrators.
It compromises the confidentiality and integrity of the Koha application by executing arbitrary code in the context of other users.
Because the malicious payload is stored on the server and triggers automatically when viewed, multiple users can be affected without any additional action.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by verifying if the Koha system is running a version up to and including 25.11 and checking for the presence of malicious stored scripts in the News function.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves stored Cross-Site Scripting (XSS) in the News entries, detection involves inspecting News entries for suspicious script tags or payloads such as "><script>alert("Stored XSS")</script>".'}, {'type': 'paragraph', 'content': 'There are no specific network commands provided, but detection can be done by logging into the Koha application with an account that has permission to add or edit news entries and reviewing the content for injected scripts.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to accounts that have permission to add or edit News entries to trusted users only.
Avoid using vulnerable versions of Koha (up to and including 25.11) and upgrade to a version where this vulnerability is fixed once available.
As a temporary measure, review and sanitize existing News entries to remove any malicious scripts.
Monitor user activity related to the News function to detect any unauthorized or suspicious edits.