CVE-2026-31844

EUVD-2026-11109
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 30.49%
Affected Products (NVD)
VendorProductVersion
kohakoha
24.11.0 ≤
𝑥
< 24.11.12
kohakoha
25.05.0 ≤
𝑥
< 25.05.07
kohakoha
25.11.00
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593
https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/
https://koha-community.org/koha-25-11-01-released/