CVE-2026-70369CWE-89sql-injection

CVE-2026-70369

High · published August 4, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-04T17:18Z
References (3)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://download.koha-community.org/koha-25.05.12.tar.gz · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://koha-community.org/koha-25-05-12-released/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 04 AUG 12:59Z
    Koha - SQL Injection in reports/acquisitions_stats.pl
    cvelistv5