medium6.5
CVE-2026-26379
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration.
Impact
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Koha | Koha | through 25.11.00 |