CVE-2026-26379

Name of the Vulnerable Software and Affected Versions Koha versions prior to 25.11

Description A Server-Side Request Forgery (SSRF) issue exists via the Z39.50/SRU server configuration, which allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times. Additionally, the Z39.50 configuration module may allow a remote attacker to execute arbitrary code.

Recommendations Update to a version later than 25.11. Restrict access to the Z39.50 configuration module to minimize the risk of exploitation.