Vulnerability · Published Mar 11, 2026 · Assigned by TuranSec
CVE-2026-31844Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
High 8.8
In plain English
A high-severity SQL injection in Koha from Koha Community. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Koha Community | Koha | 24.11.0 – through 24.11.1225.05.0 – through 25.05.0725.11.0 – through 25.11.01 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H