CVE-2026-70373

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description The circulation statistics report in reports/issues stats.pl contains a flaw where the calculate() function constructs SQL queries by concatenating user-controlled request parameters directly into the string. Specifically, the parameters PeriodTypeSel, PeriodDaySel, and PeriodMonthSel, as well as Filter slots and Line and Column identifiers, are interpolated without whitelist validation or placeholder binding. This allows an authenticated staff user with reports module permissions to perform SQL injection, enabling the unauthorized reading of database tables such as borrowers (containing password hashes, two-factor secrets, and personal data), api keys, and sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.