Koha library management system through version 25.11 contains a server‑side request forgery flaw in the Z39.50/SRU server configuration. The flaw allows an attacker who has authenticated access to the Koha instance to specify arbitrary target hosts in the configuration, causing the server to make HTTP(S) requests to internal addresses. By analyzing response timings, the attacker can map the internal network and discover services. This is a pure SSRF, not an arbitrary code execution flaw; it is classified as CWE‑918. The potential impact is unauthorized internal network reconnaissance, which could lead to further attacks if other vulnerabilities exist.

Koha library management system, versions up to and including 25.11, when the Z39.50/SRU configuration module is enabled. The vulnerability requires authentication to the Koha web interface and network access to the Z39.50 service port.

The CVSS score of 6.5 represents medium severity. The EPSS score of less than 1% indicates a low probability that the flaw will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. Attackers must already have authorized access to the Koha instance to exploit SSRF; the impact is limited to internal reconnaissance, though it can enable subsequent, more severe attacks if other weaknesses are present. The key weakness is the lack of input validation when parsing the Z39.50 configuration, manifesting as a server‑side request forgery.