CVE-2026-105107: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Koha Community Koha

CVE-2026-105107 describes a SQL injection vulnerability in Koha Community's Koha software, specifically in the reports/cat_issues_top.pl script's calculate subroutine. User-controlled parameters Criteria, Filter, and Limit are concatenated directly into dynamic SQL statements without adequate validation. Criteria is inserted verbatim into SQL identifier positions, Filter is concatenated raw into LIKE, BETWEEN, and comparison clauses, and Limit is appended raw to the LIMIT clause. This allows an authenticated staff user with reports module permission to inject arbitrary SQL and read any table accessible by the Koha database user, including sensitive tables containing borrower credentials, API keys, and session data. The vulnerability is addressed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03, as well as the 26.11 development branch. This vulnerability is related to but distinct from CVE-2026-70372 affecting a similar script.

An authenticated staff user with reports module permission can exploit this vulnerability to execute arbitrary SQL queries on the Koha database. This can lead to unauthorized disclosure of sensitive data including borrower user IDs, bcrypt password hashes, two-factor authentication secrets, personal data, API keys, and session information. The vulnerability has a high severity rating with a CVSS score of 7.6, indicating significant confidentiality and availability impact.

This vulnerability is fixed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03. Users should upgrade to one of these fixed versions or later to remediate the issue. No other mitigation or temporary workaround is documented. Since this is not a cloud service, patching the affected software versions is required to resolve the vulnerability.