CVE-2026-41921: Koha Library System Stored XSS Vulnerability

CVE-2026-41921 Overview

CVE-2026-41921 is a stored cross-site scripting (XSS) vulnerability in the Koha integrated library system. The flaw resides in the purchase suggestion handler, where authenticated staff users can submit unsanitized input through the suggestion save operation. Crafted HTML or script payloads placed in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note are persisted without sanitization. The payloads execute in the browser of any staff user who later views the suggestion list. Koha versions before 26.05.02, 25.11.07, and 25.05.13 are affected. The issue is tracked under [CWE-79].

Critical Impact
Authenticated staff attackers can execute arbitrary JavaScript in the browser context of other staff users, enabling session theft, unauthorized library workflow actions, and lateral escalation within the Koha staff interface.

Affected Products

Koha versions before 26.05.02
Koha versions before 25.11.07
Koha versions before 25.05.13

Discovery Timeline

2026-08-18 - CVE-2026-41921 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-41921

Vulnerability Analysis

The vulnerability originates in the purchase suggestion save workflow within Koha's staff interface. When a staff user submits a suggestion, the backend accepts bibliographic metadata fields without applying output encoding or HTML sanitization. Koha stores the raw input directly into the suggestion database record. When the suggestion list template renders these values into the staff HTML view, embedded <script> tags or event-handler attributes execute in the viewing user's browser session.

Because the exploit path traverses server-side storage and later template rendering, this is a persistent (stored) XSS rather than a reflected variant. Any staff user who opens the suggestions view becomes a target, including privileged accounts responsible for acquisitions, cataloging, or administrative tasks. Successful exploitation allows the attacker to hijack authenticated sessions, forge requests against Koha administrative endpoints, or exfiltrate patron and acquisition data visible to the victim.

Root Cause

The root cause is missing input sanitization and missing contextual output encoding in the purchase suggestion handler. Koha does not neutralize HTML metacharacters or script content before persisting suggestion field values, and the staff-facing template renders these values as raw HTML rather than encoded text.

Attack Vector

An authenticated staff user with permission to submit purchase suggestions crafts a suggestion where one or more bibliographic fields contain HTML or JavaScript payloads. After submission, the payload is stored. When another staff user browses the suggestion list, the browser parses and executes the injected script under the origin of the Koha staff application. User interaction is required to trigger execution, but the interaction is a routine staff workflow action.

Because no verified proof-of-concept code is published, technical details are described in prose. See the VulnCheck Advisory: Koha XSS for additional context.

Detection Methods for CVE-2026-41921

Indicators of Compromise

Purchase suggestion records containing HTML tags, <script> elements, on*= event handlers, or javascript: URIs in fields like title, author, isbn, publishercode, place, collectiontitle, itemtype, or note.
Unexpected outbound HTTP requests from staff browsers to attacker-controlled domains shortly after viewing the suggestions list.
Staff account activity, such as permission changes or bulk record modifications, occurring immediately after a suggestion view event.

Detection Strategies

Query the Koha suggestions table for entries whose text fields contain angle brackets, script keywords, or encoded HTML entities and flag them for manual review.
Enable and monitor web server access logs for POST requests to the suggestion save endpoint containing suspicious payload patterns.
Deploy a Content Security Policy (CSP) in report-only mode on the staff interface and monitor violation reports for inline script execution attempts.

Monitoring Recommendations

Alert on new suggestion submissions where field values contain non-printable characters, HTML tags, or JavaScript keywords.
Correlate staff session anomalies, such as new sessions from unfamiliar user agents, with recent suggestion view activity.
Retain browser and application logs long enough to reconstruct the full chain from suggestion submission to script execution.

How to Mitigate CVE-2026-41921

Immediate Actions Required

Upgrade Koha to 26.05.02, 25.11.07, or 25.05.13 or later, matching your current release track.
Audit existing purchase suggestion records for stored HTML or JavaScript content and remove or neutralize malicious entries.
Rotate staff session tokens and require re-authentication after upgrading to invalidate any hijacked sessions.

Patch Information

The Koha project fixed the vulnerability in the release announcements for Koha 26.05.02, Koha 25.11.07, and Koha 25.05.13. Administrators should upgrade to the fixed version on their supported release track and verify the version number after deployment.

Workarounds

Restrict the suggestions_create and related permissions to a minimal set of trusted staff users until patching is complete.
Deploy a strict Content Security Policy on the Koha staff interface that disallows inline scripts and untrusted external sources.
Place a web application firewall (WAF) rule in front of Koha to block requests to the suggestion save endpoint containing HTML tags or script keywords in bibliographic fields.

bash

# Verify installed Koha version after upgrade
dpkg -l | grep koha-common

# Search the suggestions table for potentially malicious stored content
mysql -u koha_user -p koha_db -e "SELECT suggestionid, title, author, note FROM suggestions WHERE title REGEXP '<|javascript:' OR author REGEXP '<|javascript:' OR note REGEXP '<|javascript:';"