CVE-2026-70369 | Koha Community up to 24.11.16/25.05.11/25.11.5/26.05.0 Reports acquisitions_stats.pl calculate Filter sql injection

A vulnerability labeled as critical has been found in Koha Community Koha up to 24.11.16/25.05.11/25.11.5/26.05.0. This affects the function calculate of the file reports/acquisitions_stats.pl of the component Reports Module. Executing a manipulation of the argument Filter can lead to sql injection.

This vulnerability is tracked as CVE-2026-70369. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More