CVE-2026-70369: Koha Community Koha

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

Affected products

• Koha Community Koha: up to and including 24.11.17; from 25.05.00, up to and including 25.05.12; from 25.11.00, up to and including 25.11.06; from 26.05.00, up to and including 26.05.01

Published 2026-08-04. Last modified 2026-08-26.