CVE-2026-71288

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description The guided report builder in reports/guided reports.pl is susceptible to time-based blind SQL injection. The application reads the order by CGI parameter and a dynamically-named {order} ovalue parameter, concatenating them directly into an SQL ORDER BY clause without validation or an allowlist. This occurs because the resulting string is appended verbatim to the final query in C4::Reports::Guided via the $query .= $orderby; operation. Staff accounts with create reports or execute reports permissions can exploit this to access the database, which contains patron personally identifiable information (PII) and staff or LDAP credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.