CVE-2026-70370CWE-89sql-injection

CVE-2026-70370

High · published August 4, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-04T17:18Z
References (3)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://download.koha-community.org/koha-25.05.12.tar.gz · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://koha-community.org/koha-25-05-12-released/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 04 AUG 13:00Z
    Koha - SQL Injection in reports/catalogue_stats.pl
    cvelistv5