CVE-2026-70373CWE-89sql-injection

CVE-2026-70373

High · published August 4, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-04T17:18Z
References (3)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://download.koha-community.org/koha-25.05.12.tar.gz · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://koha-community.org/koha-25-05-12-released/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 04 AUG 13:00Z
    Koha - SQL Injection in reports/issues_stats.pl
    cvelistv5