The vulnerability in Koha's reports/acquisitions_stats.pl arises from unsafe construction of SQL queries in the subroutine calculate. User-supplied Filter parameters are directly embedded into WHERE fragments involving multiple database fields such as aqbasket.closedate, aqorders.datereceived, and others. This lack of input validation or parameterization allows an attacker with low privileges to perform SQL Injection, potentially leading to unauthorized data access, modification, or denial of service. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions explicitly include 25.05.00, 25.11.00, and 26.05.00.

Successful exploitation of this vulnerability can result in complete compromise of the affected Koha system's database, including unauthorized disclosure, modification, or deletion of data. The high CVSS score indicates critical impact on confidentiality, integrity, and availability. No known exploits are reported in the wild as of the publication date.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the Koha Community advisory or official channels for updates. Until a fix is released, it is recommended to restrict access to the affected script and validate or sanitize all user inputs to mitigate injection risks.