CVE-2026-70369: Koha SQL Injection Vulnerability

CVE-2026-70369 Overview

CVE-2026-70369 is a SQL injection vulnerability in Koha's reports/acquisitions_stats.pl script. The calculate subroutine builds per-cell statistics queries by interpolating user-controlled Filter request parameters directly into WHERE fragments. The statement is prepared and executed without bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user. Exposed data includes the borrowers table (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions.

Critical Impact
Authenticated staff users can extract password hashes, API keys, session tokens, and two-factor secrets from the Koha database via crafted Filter parameters.

Affected Products

Koha Integrated Library System (versions prior to 25.05.12)
Koha reports/acquisitions_stats.pl reporting module
Koha deployments exposing the staff reports interface to authenticated users

Discovery Timeline

2026-08-04 - CVE-2026-70369 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70369

Vulnerability Analysis

The defect resides in the calculate subroutine within reports/acquisitions_stats.pl. This routine assembles SQL statements that aggregate acquisitions statistics across multiple joined tables. It concatenates Filter request parameters directly into the WHERE clause covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The resulting statement is passed to DBI's prepare and execute functions with zero placeholders. Any attacker-supplied SQL syntax reaches the database engine verbatim. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is direct string interpolation of untrusted HTTP parameters into a SQL statement. Koha's data access layer supports parameterized queries, but this reporting endpoint bypasses parameter binding for filter fragments. No input validation or allow-list constrains the filter values before they reach the SQL builder.

Attack Vector

An attacker requires an authenticated staff account with the reports module permission. The attacker submits a crafted Filter value through the acquisitions statistics form or a direct HTTP request to reports/acquisitions_stats.pl. The injected SQL executes with the privileges of the Koha database user. That user typically has read access to every table in the koha schema. The attacker can exfiltrate password hashes from borrowers, active session identifiers from sessions, and integration credentials from api_keys.

No verified public exploit code has been published. See the Koha Bug Report #42360 for the upstream technical discussion.

Detection Methods for CVE-2026-70369

Indicators of Compromise

HTTP requests to /cgi-bin/koha/reports/acquisitions_stats.pl containing SQL metacharacters such as UNION, SELECT, --, /*, or 0x in Filter parameters.
Web server logs showing unusually long query strings or repeated requests to the acquisitions statistics endpoint from a single staff account.
MariaDB or MySQL general query log entries where statements against aqorders, aqbasket, or borrowers contain nested SELECT subqueries originating from the reports endpoint.

Detection Strategies

Enable database query logging on the Koha database and alert on SELECT statements against borrowers, api_keys, sessions, or borrower_password_recovery initiated by the Koha application account outside of authentication flows.
Inspect Koha access logs for requests to acquisitions_stats.pl and correlate Filter parameter contents against a signature list of SQL injection patterns.
Monitor authenticated staff sessions for anomalous access to reporting endpoints, especially from accounts that do not typically run acquisitions reports.

Monitoring Recommendations

Forward Koha web server logs and MariaDB audit logs to a centralized log platform for retention and correlation.
Alert on any staff account that exports large result sets from the reports module in a short time window.
Track failed and successful staff logins to detect credential stuffing that may precede exploitation.

How to Mitigate CVE-2026-70369

Immediate Actions Required

Upgrade Koha to version 25.05.12 or later, which addresses the SQL injection in reports/acquisitions_stats.pl.
Audit the reports module permission and revoke it from staff accounts that do not require statistical reporting.
Rotate api_keys, staff passwords, and session secrets if exploitation is suspected.
Review the borrowers table for signs of unauthorized password hash extraction and reset affected credentials.

Patch Information

The Koha community released the fix in version 25.05.12. Download the source tarball from the Koha Software Download page. Refer to the Koha Release Announcement 25.05.12 for complete release notes and the Koha Bug Report #42360 for the upstream fix discussion.

Workarounds

Restrict access to /cgi-bin/koha/reports/acquisitions_stats.pl at the web server or reverse proxy layer until the patch is applied.
Reduce the Koha database user's privileges so it cannot read sensitive tables such as api_keys and borrower_password_recovery from the reports context.
Place a web application firewall rule in front of the Koha staff interface to block SQL metacharacters in Filter parameters submitted to the acquisitions statistics endpoint.

bash

# Example reverse proxy restriction (nginx)
location ~ ^/cgi-bin/koha/reports/acquisitions_stats\.pl$ {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://koha_backend;
}