CVE-2026-70371 Overview
CVE-2026-70371 is a SQL injection vulnerability in Koha, an open-source integrated library system. The flaw resides in the reports/issues_avg_stats.pl script, which builds dynamic SQL inside its calculate subroutine by concatenating user-controlled request parameters directly into the query string. The Line, Column, and multiple Filter parameters are not validated and land verbatim in identifier and predicate positions. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers, api_keys, and sessions [CWE-89].
Critical Impact
Authenticated staff users can extract password hashes, two-factor secrets, personal borrower data, API keys, and session tokens from the Koha database.
Affected Products
- Koha integrated library system versions prior to 25.05.12
- Koha reports/issues_avg_stats.pl reporting module
- Koha deployments granting staff users the reports module permission
Discovery Timeline
- 2026-08-04 - CVE-2026-70371 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70371
Vulnerability Analysis
The vulnerability affects the calculate subroutine within reports/issues_avg_stats.pl. The script constructs SQL queries by concatenating request parameters directly into the query text without parameterization or whitelisting. The Line and Column parameters flow into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses. Each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. The script uses no bound parameters, so an attacker can break out of the intended SQL context and append arbitrary statements or subqueries.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command. Koha's report generator trusts client-supplied form fields as safe SQL fragments. Because identifiers cannot be bound as parameters in most database drivers, the developer bypassed sanitization entirely rather than applying a strict whitelist of permitted column and table names.
Attack Vector
An attacker must first authenticate to the Koha staff interface and hold the reports module permission. The attacker then submits a crafted request to the issues_avg_stats.pl endpoint. Malicious payloads placed in the Line, Column, or Filter parameters execute against the MySQL/MariaDB backend with the privileges of the Koha database user. This exposes sensitive tables including borrowers (password hashes and two-factor secrets), api_keys, and sessions.
See the Koha Bugzilla Report #42368 for reproduction details.
Detection Methods for CVE-2026-70371
Indicators of Compromise
- Requests to /cgi-bin/koha/reports/issues_avg_stats.pl containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the Line, Column, or Filter parameters
- Unexpected SELECT queries against borrowers, api_keys, or sessions tables in MySQL general or slow query logs
- Staff accounts with reports permission generating anomalous report volumes or errors
Detection Strategies
- Enable MySQL/MariaDB general query logging and alert on queries referencing sensitive tables originating from the Koha reports module
- Deploy a Web Application Firewall (WAF) rule that inspects the issues_avg_stats.pl parameters for SQL syntax tokens
- Review Koha application logs for HTTP 500 responses tied to the reports endpoint, which often indicate injection probes
Monitoring Recommendations
- Audit which staff accounts hold the reports module permission and review activity from those accounts
- Correlate report execution events with subsequent authentication anomalies or credential misuse
- Monitor outbound traffic from the Koha server for exfiltration patterns following report generation
How to Mitigate CVE-2026-70371
Immediate Actions Required
- Upgrade Koha to version 25.05.12 or later, available from the Koha 25.05.12 Release Announcement
- Restrict the reports module permission to a minimal set of trusted staff accounts
- Rotate database credentials, staff passwords, API keys, and two-factor secrets if compromise is suspected
Patch Information
The Koha community released version 25.05.12 addressing this issue. The patched release is available from the Koha Software Download Link. The fix introduces validation of identifier parameters and parameterized query construction in the calculate subroutine.
Workarounds
- Temporarily revoke the reports module permission from all staff users until the patch is applied
- Place a WAF or reverse proxy rule in front of /cgi-bin/koha/reports/issues_avg_stats.pl to reject requests containing SQL metacharacters in Line, Column, and Filter parameters
- Restrict the Koha database user's privileges to the minimum required tables, limiting the blast radius of successful injection
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
