Koha Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Koha versions through 25.11. This issue allows remote attackers to execute arbitrary code via the News function. The vulnerability requires authentication to exploit.

Impact

Exploitation of this vulnerability allows attackers to execute scripts in the context of the user, potentially leading to unauthorized actions or data exposure.

Reproduction

To reproduce this vulnerability, log into Koha with an account that has permission to add News entries. Navigate to 'Tools' then 'News' and create a new entry. After saving, edit the post with the text editor and insert a script payload into the content. Save the changes and the script will execute when the main page is loaded.