Koha <=25.11 Stored XSS in Patron Restriction Types (CVE-2026-50765)

Vulnerability Overview CVE-2026-50765 is a stored Cross-Site Scripting (XSS) vulnerability present in the patron restriction type management pages of Koha Library Management System versions 0 to 25.11. This vulnerability allows an authenticated remote attacker (with administrator privileges) to inject arbitrary web scripts via the ( field). Scope of Impact Affected Versions: Koha Library Management System 0 to 25.11 Attack Conditions: Administrator privileges are required Attack Vector: Malicious scripts are injected through the patron restriction type management page Remediation Remediation Steps 1. Log in to the Koha Staff Interface: Log in using an administrator or superlibrarian account. 2. Navigate to Patron restriction types: Go to Administration > Patron restriction types. 3. Create a new restriction type: Set the Label field to: 4. Save the restriction type. 5. Navigate back to Patron restriction types: Open the edit form or create a new restriction type. 6. Trigger the handler: The handler is triggered when the page loads. Response Received by the Browser The browser closes the tag, renders the tag as HTML, and triggers the handler within the context of the staff intranet. Root Cause Lines 263 to 267 in the file (for Koha 24.05 and 25.11) use inside a single-quoted JavaScript string literal without applying JSON encoding. Fix Code Replace with . Conclusion An authenticated administrator navigating to Administration > Patron restriction types in the Koha Staff Interface can create or edit a restriction type, setting the Label field to a value containing a script block termination sequence and an HTML payload. This value is stored in the database unsanitized and subsequently rendered within a JavaScript object literal in the restriction type management template using the Template Toolkit filter. The injected script executes in the browsers of any staff member who loads the restriction type management page.

Goal Reached Thanks to every supporter — we hit 100%!

Koha <=25.11 Stored XSS in Patron Restriction Types (CVE-2026-50765)