CVE-2026-71288: Koha Community Koha

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.

Affected products

• Koha Community Koha: up to and including 26.05.01-1

Published 2026-08-05. Last modified 2026-08-26.