> For the complete documentation index, see [llms.txt](https://lgnas.gitbook.io/findings/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lgnas.gitbook.io/findings/cve-2026-50766.md).

# CVE-2026-50766

## About the Application

Koha is an open source, web-based integrated library system (ILS) used by libraries of all types worldwide to manage cataloguing, circulation, acquisitions and patron records. It provides two main interfaces: a staff interface (the intranet) for library administration and an Online Public Access Catalogue (OPAC) through which library users can search and browse the collection.

## About the Finding

A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with `edit_items` permission to inject arbitrary web scripts via the item public notes field (`items.itemnotes`).

## Proof of Concept

1. Log in to the Koha staff interface with an account holding `edit_items` permission.
2. Navigate to any bibliographic record and open the item editor for any attached item.
3. Set the Public Note field to: 

```
<img src="x" onerror="alert(document.domain)">
```

4. Save the item.
5. Visit the OPAC item detail page as any user (no login required):

```
http://<opac-host>/cgi-bin/koha/opac-detail.pl?biblionumber=<id>
```

6. The onerror handler fires immediately on page load.

Live HTTP evidence from a 24.05 instance confirms the server returns the payload unencoded:

```
<td class="notes" property="description">
<img src="x" onerror="alert(document.domain)">
</td>
```

## Conclusion

An authenticated staff member with edit\_items permission navigates to any bibliographic record in the staff interface, sets the Public Note field to a crafted HTML payload, and saves the item. The payload is stored in the `items.itemnotes` database column without sanitisation and is subsequently rendered verbatim in the browser of any visitor to the OPAC item detail page via the Template Toolkit `$raw` filter, including unauthenticated OPAC users who require no login to trigger execution.

#### Root cause

`opac-detail.tt line 1383 (24.05) / line 1513 (25.11)` uses `[% ITEM_RESULT.itemnotes | $raw %]` with no prior sanitisation at write time. The `borrowernotes` field in the same codebase is correctly sanitised via `C4::Scrubber->new('note')` before `storage`; `itemnotes` is not.

#### Fix&#x20;

Replace `| $raw`  with  `| html` in `opac-detail.tt` and apply `C4::Scrubber->new('note')` to `itemnotes` in `catalogue/updateitem.pl`.

<figure><img src="/files/WqYCUy03olWDLxCNkzwu" alt=""><figcaption></figcaption></figure>

{% embed url="<https://nvd.nist.gov/vuln/detail/CVE-2026-50766>" %}