CVE-2026-70373: Koha Community Koha

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Affected products

• Koha Community Koha: up to and including 24.11.17; from 25.05.00, up to and including 25.05.12; from 25.11.00, up to and including 25.11.06; from 26.05.00, up to and including 26.05.01

Published 2026-08-04. Last modified 2026-08-26.