CVE-2011-4715: Koha

Medium severity, CVSS 5.0. EPSS: 8.6% chance of exploitation in the next 30 days.

Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.

Affected products

• Koha Koha: version 3.06.00.000 only; version 3.04.00 only; version 3.04.01 only; version 3.04.02 only; version 3.04.03 only; version 3.04.04 only; …
• Koha Liblime Koha: up to and including 4.2

Published 2011-12-08. Last modified 2026-06-16.