CVE-2026-26378: Koha Invoice XSS Vulnerability – Stored Script Injection in Library Management

Technical summary

This is a stored cross-site scripting vulnerability (CWE-79) in Koha's Invoice module file upload handler. The vulnerability arises from insufficient input sanitization and output encoding of uploaded file names or content processed during invoice creation or retrieval. An authenticated attacker with permission to upload invoice files can inject malicious scripts that persist in the application. When authorized users (likely library staff) access or process the invoice, the injected script executes in their session context with the same privileges, potentially allowing session hijacking, credential theft, or unauthorized modification of library records. The CVSS 3.1 score of 5.4 (Medium) reflects the requirement for valid credentials, user interaction, and limited impact scope.

Business impact

Library staff productivity could be disrupted if attackers inject scripts that manipulate the user interface or redirect staff to phishing pages during invoice processing workflows. Compromised staff sessions could lead to unauthorized changes to patron records, financial data, or library configurations. The attack surface is limited to users with invoice management responsibilities, but the persistence of stored XSS means the threat remains until patching. For multi-branch library systems sharing a single Koha instance, a single upload could affect dozens of staff members. Reputational risk exists if patron data becomes exposed through hijacked staff accounts.

Affected systems

Koha versions 25.11 and earlier are affected. This includes all production deployments of Koha using the vulnerable release track. Organizations running self-hosted Koha instances are directly impacted. Hosted Koha service providers should verify their deployment versions immediately. The vulnerability is specific to the Invoice feature's file upload mechanism, so organizations that do not use Koha's invoicing module may have reduced but not eliminated exposure, depending on whether the vulnerable code is loaded in memory.

Exploitability

Exploitation is moderately straightforward but constrained by prerequisites. An attacker must possess valid Koha credentials with invoice upload permissions—typically a library staff member account or a compromised administrative account. The attack does not require advanced technical skill; crafting a malicious file name or embedding script in an invoice document is within the capability of script-kiddie-level attackers. However, widespread impact requires either multiple compromised accounts or social engineering to convince a legitimate staff member to upload a prepared malicious file. The CVSS vector indicates that network access is available (AV:N) and attack complexity is low (AC:L), but authentication (PR:L) and user interaction (UI:R) are mandatory barriers. The vulnerability is not publicly weaponized as of the advisory date, and no active exploitation in the wild has been reported.

Remediation

Apply the latest patched version of Koha that addresses the file upload sanitization in the Invoice module. Verify the patch version against the official Koha security advisory and release notes. Pending patching, restrict invoice upload permissions to a minimal set of trusted staff members, implement network-level access controls to Koha's invoice interface, and monitor for suspicious file uploads or unusual script tags in invoice processing logs. For organizations unable to patch immediately, consider disabling the Invoice feature if operationally feasible.

Patch guidance

Check the official Koha release notes and security advisories for the next available version after 25.11 that contains a fix for this XSS vulnerability. Apply patches during a scheduled maintenance window after testing in a non-production environment. Verify that file upload handlers properly sanitize and encode all user-supplied input before storage and retrieval. After patching, clear any invoices uploaded during the vulnerability window or inspect them manually for suspicious content. Document the patch date and scope for compliance records.

Detection guidance

Monitor web server and application logs for invoice file uploads containing script tags, JavaScript event handlers, or encoded payloads. Search for file names with extensions that suggest scripts (e.g., .js, .html mixed with invoice naming conventions). Review user access logs for unusual patterns of invoice viewing immediately after uploads. Inspect the Koha database for stored scripts within invoice records or file metadata. Implement Web Application Firewall (WAF) rules to block common XSS patterns in file upload parameters. Alert on any instance of a staff member clicking links within an invoice document, as this may indicate successful exploitation.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The Medium CVSS score and authentication requirement mean this is not a critical, worm-capable threat. However, the stored nature of the XSS and the persistence of the payload until patching mean that any exploitation will have sustained impact across multiple user sessions. Libraries should prioritize patching this within their standard monthly or quarterly security update cycle, ahead of lower-severity issues but below zero-day or high-CVSS threats. Organizations with high-risk patron data (PII, reading histories) or those in regulated environments should move it to a higher priority.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible vulnerability requiring valid credentials and user interaction, with limited confidentiality and integrity impact and no availability impact. The score would be higher if the vulnerability allowed unauthenticated exploitation or affected a wider scope than the authenticated user's session. The stored nature of XSS is a concerning factor not fully reflected in the base CVSS, as it increases the blast radius compared to reflected XSS, but the requirement for staff involvement and the narrowness of the Invoice feature module prevent a High rating.

Frequently asked questions