The flaw is a stored cross‑site scripting weakness in the file upload function of Koha 25.11 and earlier. An attacker can upload a file that contains malicious JavaScript, which is then rendered when an invoice including that file is viewed. The injected code runs in the browsers of all users who open the invoice, allowing them to execute arbitrary client‑side actions. This is a CWE‑79 type vulnerability.

Koha library management system, versions 25.11 and all earlier releases that enable file uploads within the Invoice module. The vulnerability is present whenever the file upload feature for invoices is available, regardless of user authentication level.

The attack requires an attacker to create a malicious file and a victim user to view the invoice containing that file. The likely attack vector is web‑based interaction with the invoice page and user interaction is required for exploitation. The EPSS score of < 1% indicates a very low probability of exploitation, though the potential for client‑side code execution still poses a meaningful risk. This flaw is not listed in the CISA KEV catalog, but it warrants remediation because it allows arbitrary JavaScript to run in users’ browsers.