CVE-2026-26378: Koha Library System RCE Vulnerability

CVE-2026-26378 Overview

CVE-2026-26378 is a Cross-Site Scripting (XSS) vulnerability in Koha integrated library system version 25.11 and earlier. The flaw resides in the file upload function within the Invoice features. A remote attacker can upload a crafted file to execute arbitrary script code in the context of an authenticated user's browser session. Koha is an open-source library management platform used by libraries worldwide, increasing the population of potentially exposed installations.

Critical Impact

Authenticated remote attackers can execute arbitrary script code via the Invoice file upload feature, enabling session hijacking, credential theft, and unauthorized actions within the Koha staff interface.

Affected Products

• Koha 25.11
• Koha versions prior to 25.11
• Koha Invoice file upload feature

Discovery Timeline

• 2026-06-03 - CVE-2026-26378 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-26378

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) flaw [CWE-79] in Koha's Invoice features. The application accepts file uploads without sufficient validation of file content or filename metadata. When an attacker uploads a file containing embedded JavaScript or a malicious filename, the payload is later rendered by the Koha staff interface without proper output encoding.

Koha is a Perl-based library management application that handles acquisitions, cataloging, and patron records. The Invoice module supports attachment uploads for purchase orders and vendor records. Because the uploaded content is rendered back to staff users who review invoices, the payload executes in the context of privileged sessions.

Root Cause

The root cause is missing input sanitization and output encoding on uploaded invoice attachments. The Koha Invoice handler stores user-supplied data and serves it back without applying HTML entity encoding or content-type restrictions. This violates secure file upload practices that require validating MIME types, sanitizing filenames, and serving uploads with safe Content-Disposition headers.

Attack Vector

An authenticated attacker with permission to upload invoice attachments crafts a file containing JavaScript payloads — either embedded in file contents rendered inline or in the filename itself. When another staff user views the invoice, the browser executes the injected script. This enables session token theft, forced administrative actions through Cross-Site Request Forgery (CSRF), and lateral movement within the Koha staff interface. Refer to the GitHub CVE-2026-26378 Post for additional technical details.

// No verified exploit code is publicly available.
// The attack involves uploading a file with a malicious payload
// (e.g., a filename containing <script> tags or an HTML file
// served inline) through the Koha Invoice upload endpoint.

Detection Methods for CVE-2026-26378

Indicators of Compromise

• Uploaded invoice attachments with suspicious filenames containing HTML tags, <script> markers, or unusual character encodings.
• Files uploaded to the Invoice module with MIME types inconsistent with their extensions (for example, HTML content served as image files).
• Unexpected outbound requests from staff browsers shortly after viewing invoices, suggesting payload execution.

Detection Strategies

• Inspect web server access logs for POST requests to Koha invoice upload endpoints followed by GET requests retrieving the same attachments.
• Review uploaded files in Koha storage directories for HTML, JavaScript, or SVG content that should not appear in vendor invoices.
• Deploy Content Security Policy (CSP) violation reporting to capture inline script execution attempts in the staff interface.

Monitoring Recommendations

• Monitor authentication logs for anomalous Koha staff session activity, including session token reuse from new IP addresses.
• Alert on file uploads where filenames contain HTML reserved characters such as <, >, or quotes.
• Track changes to acquisition and vendor records that follow shortly after invoice attachment views by privileged accounts.

How to Mitigate CVE-2026-26378

Immediate Actions Required

• Upgrade Koha to a version later than 25.11 once a patched release is published by the Koha community.
• Restrict invoice upload permissions to a minimal set of trusted staff accounts until patching is complete.
• Audit existing invoice attachments and remove any files containing HTML, JavaScript, or SVG content.

Patch Information

Monitor the Koha GitHub repository and official Koha security advisories for the patched release addressing CVE-2026-26378. Apply the upgrade following the Koha community's standard release procedures. The original disclosure is available at the researcher's GitHub page.

Workarounds

• Configure the web server to serve all Koha uploads with Content-Disposition: attachment headers to force downloads rather than inline rendering.
• Implement a strict Content Security Policy on the Koha staff interface that disallows inline scripts and restricts script sources.
• Apply a web application firewall rule that blocks file uploads with filenames containing HTML reserved characters or script tags.

# Example Apache configuration to force download of Koha uploads
<Directory "/var/lib/koha/uploads">
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "default-src 'none'; sandbox"
</Directory>