CVE-2026-105107 Koha Community CVE debrief

Who should care

Koha administrators, developers, and users with reports module permission should assess exposure and apply patches or updates to prevent SQL injection attacks. This includes reviewing Koha versions and configurations, monitoring for suspicious activity, and implementing compensating controls. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on the organization.

Why it matters

Koha SQL injection vulnerability CVE-2026-105107 allows authenticated staff users to inject arbitrary SQL and read sensitive data, requiring high priority assessment and patching.

• Read sensitive data, including borrower information and API keys
• Potential for lateral movement and further exploitation
• Requires verification of Koha versions and configurations
• Necessitates monitoring for suspicious activity

Technical summary

The reports/cat_issues_top.pl script in Koha concatenates user-controlled input (Criteria, Filter, and Limit) into dynamic SQL without proper validation, allowing SQL injection attacks. An authenticated staff user with reports module permission can inject arbitrary SQL and read sensitive data, including borrower information and API keys. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This vulnerability requires high priority assessment and patching by Koha administrators and developers.

Defensive priority

High priority for Koha administrators and developers to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by reviewing Koha versions and configurations
• Apply patches or updates to affected versions
• Monitor for suspicious activity and implement compensating controls
• Verify inventory and user permissions
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The reports/cat_issues_top.pl script concatenates user-controlled input (Criteria, Filter, and Limit) into dynamic SQL without proper validation, allowing SQL injection attacks. An authenticated staff user with reports module permission can inject arbitrary SQL and read sensitive data. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. Evidence is limited to public statements and CVE details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.