Koha Cross-Site Scripting Vulnerability via File Upload

A cross-site scripting (XSS) vulnerability has been identified in Koha versions through 25.11. This issue allows remote attackers to execute arbitrary code by uploading malicious files through the invoice feature.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where uploaded SVG files containing XSS payloads are executed in the user's browser.

Reproduction

To reproduce this vulnerability, create a vendor and an invoice in Koha. After the invoice is created, access the invoice files upload feature. Upload an SVG file containing a JavaScript payload, such as one that triggers an alert. Since Koha allows inline rendering of image files, the JavaScript will execute when the file is viewed.