CVE-2026-26378: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features...

CVE-2026-26378

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features...

PT-2026-46041

Name of the Vulnerable Software and Affected Versions Koha versions prior to 25.11 Description A Cross Site Scripting XSS issue exists where a remote attacker can execute arbitrary code through the file upload function within the Invoice features. Recommendations Update to version 25.11 or later...