What is CVE-2026-70373?
CVE-2026-70373 is an SQL injection vulnerability in Koha's reports/issues_stats.pl circulation statistics report, where user-controlled parameters like PeriodTypeSel, PeriodDaySel, and PeriodMonthSel are concatenated directly into the SQL query. This allows unauthorized database access through crafted requests. Immediate patching of the affected Koha instance is recommended.
Azərbaycanca: CVE-2026-70373 Koha kitabxana sistemində hesabat modulu olan reports/issues_stats.pl-də aşkarlanmış SQL injection zəifliyidir. İstifadəçi tərəfindən idarə olunan PeriodTypeSel, PeriodDaySel və PeriodMonthSel parametrləri birbaşa SQL sorğusuna daxil edilir ki, bu da məlumat bazasına icazəsiz girişə səbəb ola bilər. Təhlükəsizlik üçün Koha tətbiqini dərhal yamalamaq tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-89; shared vendor: Koha
FAQ2
In which module of the Koha system was CVE-2026-70373 discovered?
The CVE-2026-70373 vulnerability was discovered in the circulation statistics report module of the Koha library system, specifically in the reports/issues_stats.pl file.
Which parameters are used to exploit this SQL injection vulnerability?
The vulnerability is exploited through the user-controlled PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters that are concatenated directly into the SQL query.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.