Koha vulnerabilities
We track 4 vulnerabilities in Koha products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Koha vulnerabilities
- 8.8 High severity
Koha: Improper Neutralization of Directives in Dynamically Evaluated Code
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the
- 10.0 Critical severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
- 9.6 Critical severity
koha: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component.
- 8.0 High severity
koha_library_software: Improper Neutralization of Formula Elements in a CSV File
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' compone