CVE-2026-70370 Koha Community CVE debrief

Who should care

Koha users and administrators, especially those with reports module permissions, should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying and restricting report module access, monitoring for anomalies, and applying vendor patches. Additionally, security teams and vulnerability management teams should review the vulnerability and plan for potential exposure and remediation efforts. Operators of Koha systems should also be aware of the potential impact on their platforms and take steps to protect against exploitation. Security controls, such as compensating controls and monitoring, should be implemented to prevent exploitation of this vulnerability. Asset inventory and rollback/change windows should also be reviewed to ensure proper mitigation of this vulnerability. Source tracking and exposure review should also be performed to ensure that all affected systems are properly identified and remediated. The CVE record provides further details on the vulnerability and its potential impact. To mitigate this vulnerability, defenders should verify and restrict report module access, monitor for anomalies, and apply vendor patches. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. The debrief provides an overview of the vulnerability and its potential impact, and the technical summary provides a detailed analysis of the vulnerability and its exploitation. The evidence notes provide further details on the vulnerability and its potential impact, as well as the limitations of the evidence and the need for further verification. The recommended actions provide a clear plan for mitigating this vulnerability and preventing future exploitation. The defensive priority is to verify and restrict report module access, monitor for anomalies, and apply vendor patches. The evidence notes also provide details on the source grounding, evidence limits, known and unknown, and a

Technical summary

The Koha reports/catalogue_stats.pl script is vulnerable to SQL injection due to user-controlled input being directly interpolated into the SQL query without whitelist validation. An authenticated staff user with reports module permission can inject arbitrary SQL and read any table accessible by the Koha database user. The vulnerability allows for potential exposure of sensitive data, including borrowers' personal data and password hashes. To address this issue, restrict access to the reports module, monitor database queries, and apply vendor patches or updates to Koha software.

Defensive priority

Authenticated staff users with reports module permissions may be able to inject SQL; verify and restrict report module access, monitor for anomalies, and apply vendor patches.

Recommended defensive actions

• Restrict access to the reports module to only necessary personnel
• Monitor for anomalies in database queries and report usage
• Apply vendor patches or updates to Koha software
• Perform regular security audits and vulnerability assessments
• Implement additional security controls to prevent SQL injection attacks

Evidence notes

The CVE description indicates that Koha's reports/catalogue_stats.pl is vulnerable to SQL injection due to user-controlled input being directly interpolated into the SQL query without whitelist validation. An authenticated staff user with reports module permission can inject arbitrary SQL and read any table accessible by the Koha database user.

Official resources