> For the complete documentation index, see [llms.txt](https://lgnas.gitbook.io/findings/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lgnas.gitbook.io/findings/cve-2026-50767.md).

# CVE-2026-50767

## About the Application

Koha is an open source, web-based integrated library system (ILS) used by libraries of all types worldwide to manage cataloguing, circulation, acquisitions and patron records. It provides two main interfaces: a staff interface (the intranet) for library administration and an Online Public Access Catalogue (OPAC) through which library users can search and browse the collection.

## About the Finding

A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message\
field (`checkinmsg`).

## Proof of Concept

1. Log in to the Koha staff interface with an administrator account.
2. Navigate to Administration > Item types.
3. Edit or create an item type. Set the Check-in message field to:

```
<img src="x" onerror="alert(document.domain)">
```

4. Save the item type.
5. Navigate back to Administration > Item types.
6. The onerror handler fires when the item type list renders.

## Conclusion

An authenticated administrator navigates to Administration > Item types in the Koha staff interface, creates or edits an item type, and sets the Check-in message field to a crafted HTML payload. The value is stored in the database without sanitisation and subsequently rendered using an incorrect Template Toolkit filter chain that applies `html_line_break` before `$raw`. Because `html_line_break` does not encode HTML special characters and `$raw` bypasses all HTML encoding, the payload is output verbatim to the browser of any staff member who views the item type administration page.

#### Root cause

`admin/itemtypes.tt line 486 (24.05) / line 508 (25.11)` uses the filter chain `[% itemtype.checkinmsg | html_line_break | $raw %]`. Template Toolkit applies filters left to right. `html_line_break` converts newlines to tags but does not encode HTML special characters. `$raw` then outputs the combined result without any encoding.&#x20;

The correct filter order is `| html | html_line_break`, which encodes HTML characters first so special characters in the original value cannot be interpreted as markup.

#### Fix&#x20;

Change `[% itemtype.checkinmsg | html_line_break | $raw %]` to `[% itemtype.checkinmsg | html | html_line_break %]`

<figure><img src="/files/WqYCUy03olWDLxCNkzwu" alt=""><figcaption></figcaption></figure>

{% embed url="<https://nvd.nist.gov/vuln/detail/CVE-2026-50767>" %}