> For the complete documentation index, see [llms.txt](https://lgnas.gitbook.io/findings/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lgnas.gitbook.io/findings/cve-2026-50766.md).

# CVE-2026-50766

## About the Application

Koha is an open source, web-based integrated library system (ILS) used by libraries of all types worldwide to manage cataloguing, circulation, acquisitions and patron records. It provides two main interfaces: a staff interface (the intranet) for library administration and an Online Public Access Catalogue (OPAC) through which library users can search and browse the collection.

## About the Finding

A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with `edit_items` permission to inject arbitrary web scripts via the item public notes field (`items.itemnotes`).

## Proof of Concept

1. Log in to the Koha staff interface with an account holding `edit_items` permission.
2. Navigate to any bibliographic record and open the item editor for any attached item.
3. Set the Public Note field to: 

```
<img src="x" onerror="alert(document.domain)">
```

4. Save the item.
5. Visit the OPAC item detail page as any user (no login required):

```
http://<opac-host>/cgi-bin/koha/opac-detail.pl?biblionumber=<id>
```

6. The onerror handler fires immediately on page load.

Live HTTP evidence from a 24.05 instance confirms the server returns the payload unencoded:

```
<td class="notes" property="description">
<img src="x" onerror="alert(document.domain)">
</td>
```

## Conclusion

An authenticated staff member with edit\_items permission navigates to any bibliographic record in the staff interface, sets the Public Note field to a crafted HTML payload, and saves the item. The payload is stored in the `items.itemnotes` database column without sanitisation and is subsequently rendered verbatim in the browser of any visitor to the OPAC item detail page via the Template Toolkit `$raw` filter, including unauthenticated OPAC users who require no login to trigger execution.

#### Root cause

`opac-detail.tt line 1383 (24.05) / line 1513 (25.11)` uses `[% ITEM_RESULT.itemnotes | $raw %]` with no prior sanitisation at write time. The `borrowernotes` field in the same codebase is correctly sanitised via `C4::Scrubber->new('note')` before `storage`; `itemnotes` is not.

#### Fix&#x20;

Replace `| $raw`  with  `| html` in `opac-detail.tt` and apply `C4::Scrubber->new('note')` to `itemnotes` in `catalogue/updateitem.pl`.

<figure><img src="/files/WqYCUy03olWDLxCNkzwu" alt=""><figcaption></figcaption></figure>

<https://nvd.nist.gov/vuln/detail/CVE-2026-50766>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://lgnas.gitbook.io/findings/cve-2026-50766.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.