Executive brief
Koha, an open-source integrated library system, is vulnerable to a security flaw in its invoice management feature. An attacker can upload a specially crafted file that, when viewed by a staff member or administrator, executes malicious code in their web browser. This could allow an attacker to steal session information, perform actions on behalf of the user, or access sensitive library data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Koha versions up to and including 25.11 within the 'Invoice' file upload functionality (specifically cgi-bin/koha/acqui/invoice-files.pl). The application fails to properly sanitize uploaded files and allows inline rendering of SVG files with image Content-Types. An attacker can upload an SVG file containing a malicious JavaScript payload (e.g., using the 'onload' attribute). When an authenticated user views the uploaded file, the script executes within the context of their browser session, potentially leading to session hijacking or unauthorized administrative actions.
Affected products
- Koha Community Koha <= 25.11
Timeline
- 2025-12-31: disclosed: Initial researcher write-up published
- 2026-06-03: advisory: CVE published to NVD dataset