CVE-2026-105107: Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), apikeys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/borissuestop.pl (CVE-2026-70372).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kohato a version that resolves this vulnerability.Fixed in 24.11.19 - Upgrade
Upgrade
Kohato a version that resolves this vulnerability.Fixed in 25.05.14 - Upgrade
Upgrade
Kohato a version that resolves this vulnerability.Fixed in 25.11.08 - Upgrade
Upgrade
Kohato a version that resolves this vulnerability.Fixed in 26.05.03
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Koha staff user with the reports module permission can exploit it. Superlibrarian privileges are not required, and exploitation does not require user interaction.
What data could an attacker access?
The attacker can run arbitrary SQL readable by the Koha database user. This can include borrower user IDs, bcrypt password hashes, two-factor secrets, personal data, API keys, and session data.
Which Koha releases contain the fix?
The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, as well as the 26.11 development branch.
Which inputs are vulnerable?
The Criteria, Filter, and Limit request parameters supplied to reports/cat_issues_top.pl are vulnerable. Criteria reaches SQL identifier positions, Filter is inserted into quoted comparison fragments, and Limit is appended to the LIMIT clause.