Executive Summary

CVE-2026-26377 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting Koha versions up to and including 25.11.

This vulnerability requires authentication to exploit and involves an attacker injecting malicious scripts via the News function that are persistently stored on the server.

When other users view the stored malicious content, the script executes in their browsers without requiring social engineering.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability allows attackers to exfiltrate sensitive data and impersonate high-privileged users, including administrators.

It compromises the confidentiality and integrity of the Koha application by executing arbitrary code in the context of other users.

Because the malicious payload is stored on the server and triggers automatically when viewed, multiple users can be affected without any additional action.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by verifying if the Koha system is running a version up to and including 25.11 and checking for the presence of malicious stored scripts in the News function.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves stored Cross-Site Scripting (XSS) in the News entries, detection involves inspecting News entries for suspicious script tags or payloads such as "><script>alert("Stored XSS")</script>".'}, {'type': 'paragraph', 'content': 'There are no specific network commands provided, but detection can be done by logging into the Koha application with an account that has permission to add or edit news entries and reviewing the content for injected scripts.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to accounts that have permission to add or edit News entries to trusted users only.

Avoid using vulnerable versions of Koha (up to and including 25.11) and upgrade to a version where this vulnerability is fixed once available.

As a temporary measure, review and sanitize existing News entries to remove any malicious scripts.

Monitor user activity related to the News function to detect any unauthorized or suspicious edits.

Useful 0 Not Useful 0