CVE-2026-41921: Koha Stored XSS via Purchase Suggestion Handler
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Authenticated Koha staff users who can submit purchase suggestions can inject the payload. It executes in the browser of staff users who later view the suggestion list, so exposure is limited to installations where staff use this workflow.
What does an attacker need to exploit this issue?
An attacker needs authenticated staff access and must submit crafted HTML or script content through the suggestion save operation. No additional technical complexity is indicated, but a staff user must subsequently view the stored suggestion.
Which purchase-suggestion fields should be treated as potentially malicious?
The affected input fields include title, author, isbn, publishercode, place, collectiontitle, itemtype, and note. These values are stored without sanitization and rendered in the suggestion list template.
Which versions should be updated?
Versions before 26.05.02, 25.11.07, and 25.05.13 are affected. Upgrade to the applicable listed release or later.