Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Koha News function allows arbitrary code execution
CVE-2026-26377
Summary
The News function in Koha library software has a security issue that could allow an attacker to run malicious code on a library's website. This could lead to unauthorized access to sensitive data or disruption of library services. Update to the latest version of Koha to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| koha | koha | <= 25.11.00 | – |
Original title
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.
Original description
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.
nvd CVSS3.1
5.4
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
- https://g03m0n.github.io/ Third Party Advisory
- https://g03m0n.github.io/posts/cve-2026-26377/ Exploit Third Party Advisory
- https://github.com/Koha-Community/Koha Product
Published: 5 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026