Koha is vulnerable to SQL injection in the Most‑circulated items report, where the user‑controlled Criteria, Filter, and Limit request parameters are concatenated directly into dynamic SQL without validation. The Criteria parameter is inserted into identifier positions, Filter values are yet again concatenated raw into LIKE, BETWEEN, and comparison fragments, and Limit is appended to a LIMIT clause. An authenticated staff user who has the Reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user. Consequently an attacker could retrieve borrowers’ userid and bcrypt password hashes, two‑factor secrets, personal data, API keys, and session records.

This flaw affects Koha Community installations prior to the release of any of the following fixed branches: 24.11.19, 25.05.14, 25.11.08, 26.05.03, and the 26.11 development branch. All users who install the default reports module on these versions are susceptible.

The CVSS score of 7.2 reflects a high severity impact on confidentiality. The EPSS score of <1% indicates the likelihood of exploitation is low, and it has not been listed in the CISA KEV catalog. The vulnerability requires a staff user with Reports module permission; however, no superlibrarian rights are necessary. A malicious actor could exploit the vulnerability via the web interface to retrieve sensitive database contents.