CVE-2026-70371: Koha - SQL Injection in reports/issues_avg_stats.pl

Published Aug 4, 2026

Updated

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Affected Software

1 affected component

Koha

Event History

Aug 4, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-70371?

The severity of CVE-2026-70371 is rated at 58, indicating a moderate risk level.

What is the nature of CVE-2026-70371?

CVE-2026-70371 is an SQL Injection vulnerability found in Koha's reports/issues_avg_stats.pl.

How do I fix CVE-2026-70371?

To address CVE-2026-70371, sanitize and validate user inputs before using them in dynamic SQL queries.

Which software is affected by CVE-2026-70371?

CVE-2026-70371 affects Koha's issues_avg_stats.pl script.

When was CVE-2026-70371 published?

CVE-2026-70371 was published on August 4, 2026.