CVE-2026-70370: Koha SQL Injection Vulnerability

CVE-2026-70370 Overview

CVE-2026-70370 is a SQL injection vulnerability in Koha, an open source integrated library system. The flaw resides in reports/catalogue_stats.pl, where the calculate subroutine builds dynamic SQL by interpolating user-controlled Line and Column request parameters directly into identifier positions of the query. The affected SQL clauses include SELECT DISTINCTROW, GROUP BY, and ORDER BY, none of which validate input against a whitelist. When Line contains itemcallnumber and cotedigits is truthy, cotedigits is concatenated raw as the numeric argument of a LEFT() call. Authenticated staff users with the reports module permission can inject arbitrary SQL against the Koha database.

Critical Impact
Attackers can read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Affected Products

Koha Integrated Library System versions prior to 25.05.12
Koha installations exposing reports/catalogue_stats.pl to authenticated staff users
Any Koha deployment granting the reports module permission to staff accounts

Discovery Timeline

2026-08-04 - CVE-2026-70370 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70370

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] caused by string concatenation of untrusted input into a SQL query. Koha's reports/catalogue_stats.pl script accepts the Line, Column, and cotedigits HTTP parameters and inserts their values directly into identifier positions of the generated statement. Identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY cannot be protected by parameter binding, so the developer must apply strict allow-list validation. That validation is absent in the calculate subroutine.

Exploitation requires authentication as a staff user holding the reports module permission. Once authenticated, the attacker submits a crafted report request whose Line or Column value contains SQL fragments. The database engine executes the injected SQL under the identity of the Koha database user, granting read access to every table that user can reach.

Root Cause

The root cause is missing input validation in reports/catalogue_stats.pl. The calculate subroutine treats Line, Column, and cotedigits as trusted identifiers and interpolates them into the query string. When Line contains itemcallnumber and cotedigits is truthy, cotedigits is concatenated as the raw numeric argument of a LEFT() call, providing an additional injection point.

Attack Vector

The attack is delivered over the network against the Koha staff interface. An authenticated attacker with the reports module permission submits a crafted request to reports/catalogue_stats.pl containing SQL syntax in the Line, Column, or cotedigits parameters. The server passes the poisoned identifiers into the dynamic query. Successful injection allows arbitrary read access to Koha tables, exposing borrower password hashes, two-factor authentication secrets, personal data, API keys, and active session records. See the Koha Bug Report #42363 for the technical write-up.

Detection Methods for CVE-2026-70370

Indicators of Compromise

Requests to reports/catalogue_stats.pl containing SQL keywords such as UNION, SELECT, SLEEP, or -- inside the Line, Column, or cotedigits parameters.
Web server access logs showing unusually long or URL-encoded values for Line= or Column= on the catalogue statistics endpoint.
Database logs recording queries against borrowers, api_keys, or sessions that originate from the reports subsystem context.
Anomalous read volume from the Koha database user account tied to staff report generation.

Detection Strategies

Enable MySQL or MariaDB general query logging on the Koha database and alert on SELECT statements targeting borrowers.password, borrowers.secret, or api_keys from the reports code path.
Deploy web application firewall rules that inspect Line, Column, and cotedigits parameters for SQL metacharacters before they reach catalogue_stats.pl.
Correlate staff authentication events with subsequent bulk data extraction to identify abuse of the reports permission.

Monitoring Recommendations

Audit the roster of staff accounts holding the reports module permission and remove the privilege from users who do not need it.
Monitor outbound response sizes from reports/catalogue_stats.pl; large responses may indicate successful data extraction.
Alert on repeated 500-level errors from the reports endpoint, which often accompany injection probes.

How to Mitigate CVE-2026-70370

Immediate Actions Required

Upgrade to Koha 25.05.12 or later, which patches the calculate subroutine in reports/catalogue_stats.pl. See the Koha 25.05.12 Release Announcement.
Restrict the reports module permission to a minimal set of trusted staff accounts until the patch is applied.
Rotate credentials, API keys, and two-factor secrets for any Koha instance that may have been queried by untrusted staff.

Patch Information

The Koha community released the fix in version 25.05.12. The updated package is available from the Koha Download Package 25.05.12. Administrators should follow the standard Koha upgrade procedure and verify that reports/catalogue_stats.pl reflects the patched calculate subroutine after upgrade.

Workarounds

Remove or block network access to reports/catalogue_stats.pl at the reverse proxy until the upgrade is complete.
Revoke the reports module permission from all staff accounts as a temporary control.
Restrict the Koha database user's SELECT privileges on sensitive tables such as borrowers, api_keys, and sessions where operationally feasible.

bash

# Example nginx block to deny access to the vulnerable endpoint
location = /cgi-bin/koha/reports/catalogue_stats.pl {
    deny all;
    return 403;
}