Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter,…

CVE-2026-71288 describes a SQL injection vulnerability in Koha's guided report builder (reports/guided_reports.pl). The flaw arises from unsanitized concatenation of the 'order_by' CGI parameter and a dynamically-named '{order}_ovalue' parameter directly into an SQL ORDER BY clause. No allowlist or validation is applied, and because ORDER BY clauses cannot use prepared-statement placeholders, the vulnerability cannot be mitigated by standard parameterization alone. Any staff account holding the low-privilege 'create_reports' or 'execute_reports' permission can exploit this to perform time-based blind SQL injection. The Koha database contains sensitive patron PII as well as staff and LDAP credentials, making successful exploitation high-impact. This affects library management systems running vulnerable Koha versions globally.