> For the complete documentation index, see [llms.txt](https://lgnas.gitbook.io/findings/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lgnas.gitbook.io/findings/cve-2026-50765.md).

# CVE-2026-50765

## About the Application

Koha is an open source, web-based integrated library system (ILS) used by libraries of all types worldwide to manage cataloguing, circulation, acquisitions and patron records. It provides two main interfaces: a staff interface (the intranet) for library administration and an Online Public Access Catalogue (OPAC) through which library users can search and browse the collection.

## About the Finding

A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (`display_text` field).

## Proof of Concept

1. Log in to the Koha staff interface with an administrator or superlibrarian account.
2. Navigate to Administration > Patron restriction types.
3. Create a new restriction type. Set the Label field to:

```
';</script><img src="x" onerror="alert(document.domain)">
```

4. Save the restriction type.
5. Navigate back to Administration > Patron restriction types, or open the edit form for any other restriction type.
6. The onerror handler fires when the page loads.

The browser receives the following from the server:

```
  <script>
      var existing = {
          MYCODE: ';</script><img src="x" onerror="alert(document.domain)">',
          };
  </script>
  <img src="x" onerror="alert(document.domain)">
```

The browser closes the script block at `</script>`, renders the `img` tag as HTML, and fires the `onerror` handler in the staff intranet context.

## Conclusion

An authenticated administrator navigates to Administration > Patron restriction types in the Koha staff interface, creates or edits a restriction type, and sets the Label field to a crafted value containing a script block termination sequence followed by an HTML payload. The value is stored in the database without sanitisation and subsequently rendered without encoding inside a JavaScript object literal in the restriction type administration template using the Template Toolkit `$raw` filter. The injected script executes in the browser of any staff member who loads the restriction type administration page.

#### Root cause

`admin/restrictions.tt lines 263 to 267 (both 24.05 and 25.11)` use `[% ex.display_text | $raw %]` inside a single-quoted JavaScript string literal with no JSON encoding applied.

#### Fix

Replace `[% ex.code | $raw %]: '[% ex.display_text | $raw %]'` with `[% ex.code | json %]: [% ex.display_text | json %]`

<figure><img src="/files/WqYCUy03olWDLxCNkzwu" alt=""><figcaption></figcaption></figure>

{% embed url="<https://nvd.nist.gov/vuln/detail/CVE-2026-50765>" %}