Executive brief
A security vulnerability exists in the Koha Library Management System, a platform used by libraries to manage catalogs and patron records. An authorized staff member can inject malicious code into the public notes section of a book or item. When other users, including members of the general public browsing the library's online catalog, view that item, the malicious code executes in their browser, potentially allowing for the theft of login information or unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the OPAC (Online Public Access Catalogue) item detail page of Koha. The root cause is the failure to sanitize the 'items.itemnotes' field before storage and the subsequent use of the '| $raw' filter in the Template Toolkit (specifically in opac-detail.tt), which renders the content without HTML encoding. An authenticated attacker with 'edit_items' permissions can inject arbitrary JavaScript into the Public Note field. This script is then executed in the context of any user, including unauthenticated public visitors, who views the affected item's detail page. The vulnerability is present in versions through 25.11.
Affected products
- Koha Koha Library Management System Through 25.11
Timeline
- 2026-06-26: disclosed: CVE published to NVD