Executive brief
Koha is an open-source system used by libraries to manage book catalogs, circulation, and member records. A security flaw in the administrative interface allows a user with administrative access to plant malicious scripts within the 'check-in message' field of an item type. If another staff member views the affected administration page, the script could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the item type administration page of Koha Library Management System through version 25.11. The root cause is an incorrect Template Toolkit filter chain in 'admin/itemtypes.tt' (specifically line 508 in v25.11) that uses '| html_line_break | $raw'. Because '$raw' bypasses HTML encoding and 'html_line_break' only converts newlines to tags without sanitizing special characters, arbitrary HTML and JavaScript can be injected into the 'checkinmsg' field. An authenticated attacker with administrator privileges can exploit this to execute scripts in the context of other staff members' sessions. The recommended fix is to update the filter chain to '| html | html_line_break' to ensure proper encoding before rendering.
Affected products
- Koha Koha Library Management System through 25.11
Timeline
- 2026-06-26: disclosed: CVE-2026-50767 published to NVD