CVE-2026-41921

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Koha Library Software

Publication date: 2026-08-18

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-31

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-41921

Affected Vendors & Products

Vendor	Product	Version / Range
koha	koha	to 26.05.02 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Koha, an open-source library management system. It allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the purchase suggestion feature. The injected scripts are stored in fields like title, author, or ISBN and later executed when other staff users view the suggestions.

Detection Guidance

To detect this vulnerability, inspect Koha's purchase suggestion feature for unsanitized input fields like title, author, isbn, or note. Check if malicious scripts are stored in the suggestion list by reviewing database entries or template outputs. No specific commands are provided in the context.

Impact Analysis

An attacker with staff access could steal session cookies, perform actions on behalf of users, or redirect staff to malicious sites. This could lead to unauthorized access to sensitive library data or compromise of user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using affected Koha versions may face compliance risks if data is compromised.

Mitigation Strategies

Upgrade Koha to version 26.05.02, 25.11.07, or 25.05.13 or later to patch the stored XSS vulnerability. Ensure input sanitization is applied to all fields in the purchase suggestion handler before storing data.

Hi! I’m here to help you understand CVE-2026-41921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70