CVE-2026-31844
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
HIGH 8.7EPSS 0.6%
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
- Affected
- Koha Community · Koha
- CVSS v4.0 CNA
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 CNA
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 CNA
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 0.59% chance of exploitation in the next 30 days, 47th percentile
- Published
- 2026-03-11
- Updated
- 2026-08-10
Proof-of-concept exploits (1)
- Mothra-1/CVE-2026-318441★ · 2026-03-13
Security advisories
- https://koha-community.org/koha-25-11-01-released
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593