CVE-2026-70372 Overview
CVE-2026-70372 is a SQL injection vulnerability in Koha's reports/bor_issues_top.pl script. The calculate subroutine builds dynamic SQL by concatenating user-controlled request parameters directly into the query string. The Criteria parameter is placed verbatim into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses. Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, and the Limit parameter is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission can inject arbitrary SQL against the Koha database.
Critical Impact
An authenticated staff user holding the reports permission can read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
Affected Products
- Koha integrated library system (versions prior to 25.05.12)
- reports/bor_issues_top.pl component
- Deployments exposing the staff client interface to authenticated users
Discovery Timeline
- 2026-08-04 - CVE-2026-70372 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70372
Vulnerability Analysis
The vulnerability resides in the calculate subroutine of reports/bor_issues_top.pl within the Koha integrated library system. The script constructs SQL statements by concatenating request parameters directly into the query body without parameterization or strict validation. This produces a classic SQL injection sink [CWE-89].
Three distinct parameters contribute to the injection surface. The Criteria parameter is only normalized by prefixing a table name and is never checked against an allowlist. Because Criteria values are placed into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY, an attacker can pivot the query structure by injecting expressions, subqueries, or UNION fragments. The Filter parameters are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, allowing quote-breaking payloads. The Limit parameter is appended raw to the LIMIT clause, enabling stacked expressions or additional injection payloads.
Root Cause
The root cause is missing parameterization and missing allowlist validation for identifier and value positions. Koha's report generator trusts input handled through the staff interface, yet the query construction path never binds parameters or restricts Criteria to known column names.
Attack Vector
Exploitation requires an authenticated staff account holding the reports module permission. The attacker submits crafted values for Criteria, Filter, or Limit to the top borrower issues report endpoint. Injected SQL executes with the privileges of the Koha database user, granting read access to sensitive tables such as borrowers, api_keys, and sessions. Refer to Koha Bug Report #42369 for the technical write-up.
Detection Methods for CVE-2026-70372
Indicators of Compromise
- Requests to reports/bor_issues_top.pl containing SQL metacharacters, UNION, SELECT, or comment sequences within Criteria, Filter, or Limit parameters.
- Unusual read activity by the Koha database user against borrowers, api_keys, or sessions tables outside normal reporting patterns.
- Staff user accounts with reports permission generating high volumes of report requests in short intervals.
Detection Strategies
- Deploy web application firewall rules that inspect query strings sent to bor_issues_top.pl for SQL syntax patterns in the flagged parameters.
- Enable MySQL or MariaDB general query logging for the Koha database and alert on queries referencing information_schema, mysql.user, or nested SELECT statements originating from report scripts.
- Correlate staff authentication events with report execution events to identify anomalous accounts abusing the reports permission.
Monitoring Recommendations
- Audit which staff accounts hold the reports module permission and remove access from users who do not need it.
- Monitor outbound queries from the Perl reporting layer for unexpected identifier or clause structures.
- Track access patterns to sensitive columns such as borrowers.password and borrowers.secret and alert on any read outside approved workflows.
How to Mitigate CVE-2026-70372
Immediate Actions Required
- Upgrade Koha to version 25.05.12 or later, which addresses the injection in reports/bor_issues_top.pl. See the Koha 25.05.12 release announcement.
- Restrict the reports module permission to a minimal set of trusted staff accounts until the upgrade is applied.
- Rotate api_keys values and force password resets for staff accounts if exposure is suspected.
Patch Information
The fix is included in Koha 25.05.12. Download the release package from Koha Package Download 25.05.12. Details of the code change are tracked in Koha Bug Report #42369.
Workarounds
- Temporarily revoke the reports module permission from non-administrative staff until the patch is applied.
- Place the Koha staff interface behind IP allowlisting or VPN access to reduce the attacker population.
- Configure the database account used by Koha with least-privilege read constraints where possible to limit blast radius on injected queries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
