---
id: CVE-2026-31844
title: >-
  An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff
  interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to
  improper validation of the displayby parameter used by the GetDistinctValues
  functiona…
summary: >-
  An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff
  interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to
  improper validation of the displayby parameter used by the GetDistinctValues
  functiona…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: koha
product: koha
affected:
  - 'koha >= 24.11.0, < 24.11.12'
  - 'koha >= 25.05.0, < 25.05.07'
  - koha = 25.11.00
patched:
  - koha 25.05.07
published: '2026-03-11'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31844'
references:
  - url: 'https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://koha-community.org/koha-25-11-01-released/'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
tags:
  - nvd
  - exploit-available
epss: 0.0057
epssPercentile: 0.44863
ingestedAt: '2026-08-10T12:39:46.237Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Mothra-1/CVE-2026-31844'
  checkedAt: '2026-09-26T09:05:41.879Z'
exploitAvailable: true
---

## Overview

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

## Affected

- `koha >= 24.11.0, < 24.11.12`
- `koha >= 25.05.0, < 25.05.07`
- `koha = 25.11.00`

## Remediation

Upgrade past the affected range:

- `koha 25.05.07`