CVE-2026-70372: Koha - SQL Injection in reports/bor_issues_top.pl
Published Aug 4, 2026
·Updated
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), apikeys, and sessions.
Affected Software
1 affected component
Koha
Event History
Aug 4, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-70372?
CVE-2026-70372 has a risk score of 58.
2
What type of vulnerability is CVE-2026-70372?
CVE-2026-70372 is classified as an SQL Injection vulnerability.
3
How do I fix CVE-2026-70372?
To fix CVE-2026-70372, ensure that all user-controlled parameters are properly sanitized and parameterized in SQL queries.
4
Which software is affected by CVE-2026-70372?
CVE-2026-70372 affects Koha software.
5
What component is vulnerable in CVE-2026-70372?
CVE-2026-70372 affects the reports/bor_issues_top.pl component of Koha.