CVE-2026-26378: XSS
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Koha Invoice file upload featurefrom your environment.Uninstall or remove the Invoice file upload functionality if it is not required.
- Configuration
Disable the file upload function in the Invoice feature to prevent execution of malicious uploaded content that can lead to XSS.
Koha (Invoice feature) file_upload = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26378?
CVE-2026-26378 has a medium severity rating of 5.4 on the CVSS scale.
What type of vulnerability is CVE-2026-26378?
CVE-2026-26378 is a Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-26378?
To fix CVE-2026-26378, upgrade Koha to version 25.12 or later that addresses this vulnerability.
What software is affected by CVE-2026-26378?
CVE-2026-26378 affects Koha versions 25.11 and earlier.
Can CVE-2026-26378 allow remote exploitation?
Yes, CVE-2026-26378 allows a remote attacker to execute arbitrary code via the file upload function.