What is CVE-2026-71288?
CVE-2026-71288 is a critical SQL injection vulnerability found in Koha's guided report builder module. The `order_by` CGI parameter is directly concatenated into an SQL ORDER BY clause without validation, enabling remote attackers to inject arbitrary SQL code and potentially read or manipulate the database. Koha administrators must urgently apply the vendor security patch or restrict access to the reporting interface.
Azərbaycanca: CVE-2026-71288 Koha kitabxana sisteminin hesabat generatorunda aşkar edilmiş kritik SQL inyeksiya boşluğudur. `order_by` CGI parametri vasitəsilə təsdiqlənməmiş SQL kodu ORDER BY ifadəsinə birbaşa daxil edilir ki, bu da uzaqdan hücumçuya verilənlər bazasını oxumağa və ya manipulyasiya etməyə imkan verir. Koha istifadəçiləri dərhal vendorun təqdim etdiyi təhlükəsizlik yeniləməsini tətbiq etməli və ya müvəqqəti olaraq hesabat interfeysinə girişi məhdudlaşdırmalıdır.
Related CVEs
link basis: same weakness class CWE-89; shared vendor: Koha
FAQ2
In which module of Koha was CVE-2026-71288 discovered, and what specific parameter creates the attack vector?
The vulnerability was discovered in Koha's guided report builder module. The attack vector is created by the unvalidated `order_by` CGI parameter, which is directly concatenated into an SQL ORDER BY clause.
What urgent measures are recommended for Koha administrators regarding CVE-2026-71288?
Koha administrators must urgently apply the vendor security patch or restrict access to the reporting interface.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.