CVE-2026-41921
Koha Stored XSS via Purchase Suggestion Handler
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.
| CWE | CWE-79 |
| Vendor | koha community |
| Product | koha |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for koha community koha
Be the first to know when new medium vulnerabilities affecting koha community koha are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Koha Community / Koha
26.05.0 < 26.05.02 25.11.0 < 25.11.07 25.05.0 < 25.05.13
References
koha-community.org: https://koha-community.org/koha-26-05-02-released/ koha-community.org: https://koha-community.org/koha-25-11-07-released/ koha-community.org: https://koha-community.org/koha-25-05-13-released/ vulncheck.com: https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler
Credits
Alex Williams from Pellera Technologies VulnCheck