CVE-2026-107084 SLiMS CVE debrief

Who should care

Defenders responsible for Slims 9 Bulian 9.8.0 deployments, particularly those managing library management systems, should assess exposure and verify the presence of CSRF tokens and POST confirmation in loan history maintenance operations.

Why it matters

CVE-2026-107084 is a CSRF vulnerability in Slims 9 Bulian 9.8.0 that allows data loss of loan history records. Defenders managing library management systems should assess exposure, verify CSRF tokens and POST confirmation, and review configurations to ensure proper validation.

• Data loss of loan history records due to destructive operations
• Potential disruption to library management operations
• Need for verification of CSRF tokens and POST confirmation in loan history maintenance operations
• Priority for reviewing and updating configurations to ensure proper validation

Technical summary

The CVE-2026-107084 vulnerability is a CSRF issue in Slims 9 Bulian 9.8.0 that allows an attacker to perform destructive operations against admin/modules/circulation/loan_history_maintenance.php with no CSRF token or POST confirmation, leading to data loss of loan history records. This vulnerability affects Slims 9 Bulian 9.8.0 deployments, particularly those managing library management systems. Defenders should assess exposure, verify CSRF tokens and POST confirmation, and review configurations to ensure proper validation.

Defensive priority

Defenders should prioritize verifying the presence of CSRF tokens and POST confirmation in loan history maintenance operations, reviewing and updating configurations to ensure proper validation.

Recommended defensive actions

• Verify the presence of CSRF tokens and POST confirmation in loan history maintenance operations
• Review and update configurations to ensure proper validation
• Monitor for suspicious activity related to loan history maintenance
• Perform a thorough review of library management system configurations
• Check for any existing compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review vendor guidance for affected product deployments

Evidence notes

The CVE record and source item provide details on the CSRF vulnerability in Slims 9 Bulian 9.8.0. However, the record does not provide information on affected versions or vendor remediation. Defenders should verify the presence of CSRF tokens and POST confirmation in loan history maintenance operations, review configurations to ensure proper validation, and monitor for suspicious activity. The vulnerability allows an attacker to perform destructive operations against admin/modules/circulation/loan_history_maintenance.php with no CSRF

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.