CVE-2026-31844CWE-89sql-injection

CVE-2026-31844

High · published March 11, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00592 · 47.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-11T11:16Z
Affected products (3)
ProductVersionsFixed in
koha/koha≥ 24.11.0, < 24.11.1224.11.12
koha/koha≥ 25.05.0, < 25.05.0725.05.07
koha/kohaall versions—
References (3)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://koha-community.org/koha-25-11-01-released/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 11 MAR 06:34Z
    Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
    cvelistv5