CVE-2026-105107: Koha Library System SQL Injection Vulnerability

CVE-2026-105107 Overview

CVE-2026-105107 is a SQL injection vulnerability in Koha, the open-source integrated library system. The flaw resides in the Most-circulated items report script reports/cat_issues_top.pl, where the calculate subroutine concatenates user-controlled request parameters directly into dynamic SQL. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user. Affected data includes the borrowers table (userids, bcrypt password hashes, two-factor secrets, personal data), api_keys, and session records. This issue is the unpatched twin of reports/bor_issues_top.pl tracked as CVE-2026-70372.

Critical Impact

Authenticated staff users without superlibrarian privileges can exfiltrate credential hashes, API keys, two-factor secrets, and personally identifiable borrower data from the Koha database.

Affected Products

• Koha versions prior to 24.11.19
• Koha versions prior to 25.05.14, 25.11.08, and 26.05.03
• Koha 26.11 development branch prior to the fix

Discovery Timeline

• 2026-10-14 - CVE-2026-105107 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105107

Vulnerability Analysis

The vulnerability lives in reports/cat_issues_top.pl inside the calculate subroutine. The script accepts three request parameters that drive report generation: Criteria, Filter, and Limit. All three are concatenated directly into SQL strings without parameterization. The Criteria parameter is applied to identifier positions in SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query. The Filter values are inserted into single-quoted LIKE, BETWEEN, and comparison fragments. The Limit parameter is appended raw to a LIMIT clause.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Criteria undergoes only a prefix-normalization step and is never validated against an allow-list of column names. Filter and Limit receive no sanitization at all. Because Koha uses a single database account for application queries, injected SQL inherits that account's full read access across tables outside the reporting scope.

Attack Vector

Exploitation requires an authenticated session for a staff user holding the reports module permission. The superlibrarian role is not required, which broadens the pool of accounts capable of triggering the flaw. An attacker submits crafted values for Criteria, Filter, or Limit to the Most-circulated items report endpoint. The injected payload executes within the DBI session and returns arbitrary query results, enabling extraction of borrower credentials, API keys, and session tokens. See the Koha Bug Report #42736 for additional context.

Detection Methods for CVE-2026-105107

Indicators of Compromise

• Unexpected requests to reports/cat_issues_top.pl containing SQL keywords such as UNION, SELECT, --, or INFORMATION_SCHEMA in the Criteria, Filter, or Limit parameters.
• Database query logs showing reads against borrowers, api_keys, or sessions tables originating from report generation activity.
• Staff accounts with only the reports permission executing high-volume or anomalous report requests.

Detection Strategies

• Enable MySQL or MariaDB general query logging and alert on queries from the Koha database user that reference sensitive tables outside normal reporting flows.
• Inspect Apache or Plack access logs for the cat_issues_top.pl endpoint with suspicious parameter payloads.
• Review Koha staff action logs for unexpected report invocations by low-privilege accounts.

Monitoring Recommendations

• Baseline normal Criteria, Filter, and Limit parameter values and alert on deviations containing SQL metacharacters.
• Monitor for sudden access patterns against borrowers.password, borrowers.secret, or api_keys columns from the application database user.
• Track staff user permission assignments to identify accounts newly granted the reports module permission.

How to Mitigate CVE-2026-105107

Immediate Actions Required

• Upgrade Koha to version 24.11.19, 25.05.14, 25.11.08, or 26.05.03 as appropriate for your release branch.
• Rotate all borrower passwords, API keys, and session tokens if exploitation is suspected, since bcrypt hashes and two-factor secrets may have been exfiltrated.
• Audit staff accounts carrying the reports module permission and remove it from users who do not require report access.

Patch Information

The Koha community has released fixed builds in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, as well as the 26.11 development branch. Patched releases are available on the Koha Community Download Page. Technical details for the fix are tracked in Koha Bug Report #42736. Administrators should also review the related CVE-2026-70372 Record covering the sibling bor_issues_top.pl script.

Workarounds

• Restrict the reports module permission to trusted superlibrarian-equivalent staff until the upgrade is applied.
• Place a web application firewall rule in front of /cgi-bin/koha/reports/cat_issues_top.pl that blocks SQL metacharacters in Criteria, Filter, and Limit parameters.
• Enforce least privilege on the Koha database user to limit readable tables where operationally feasible.