The Koha community is proud to announce the release of version 25.05.14. This is a security release.

As always, you can download the release from: https://download.koha-community.org

Please continue reading for the details of this release.

RELEASE NOTES FOR KOHA 25.05.14

24 Aug 2026

Koha is the first free and open source software library automation
package (ILS). Development is sponsored by libraries of varying types
and sizes, volunteers, and support companies from around the world. The
website for the Koha project is:

• Koha Community

Koha 25.05.14 can be downloaded from:

• Download

Installation instructions can be found at:

• Koha Wiki
• OR in the INSTALL files that come in the tarball

Koha 25.05.14 is a security release.

It includes 6 bugfixes.

System requirements

You can learn about the system components (like OS and database) needed for running Koha on the community wiki.

Security bugs

• 42736 SQL Injection in reports/cat_issues_top.pl via Criteria / Filter request parameters (unvalidated string context, no placeholders)
• 42800 Potential XSS in shelf list in the erm module
• 42904 Prevent XSS in patron restriction comments

Bugfixes

Architecture, internals, and plumbing

Critical bugs fixed

• 30233 [ZDI-CAN-29165] Remote code execution in user-supplied regex
  

  This change refactors the regular expression handling for Batch Item Modification, MARC Modification templates, and Callnumber splitting. It moves from Perl’s traditional compile-time regular expression handling to a more dynamic (but restrictive) run-time regular expression handling more similar to Python’s “sub” regex method. This functions to reduce vulnerabilities to code injection into Koha’s Perl backend.

MARC Bibliographic data support

Other bugs fixed

• 43085 Fix typo in data/marc21_field_006.xml
  

  This fixes the text label shown in the plugin/value builder for MARC21 006 tag when “CF – Computer Files” is selected. The label “12-18 – Undefined” was changed to “12-17 – Undefined”.

  (Change only for Koha 25.05 – made to later releases by Bug 40284 – MARC21: Adjust maxlength for 005, 006 and 007.)

  Sponsored by Toi Ohomai Institute of Technology, New Zealand

Reports

Other bugs fixed

• 8127 Most-circulated items report doesn’t work when limited by library
  

  This fixes some of the filters for the “Most-circulated items” report so that using limits (the Limits section with “Limit to” and “By”) now works.

  Previously some options for “By” (such as Library and Week) generated an error message or there were no results (when results were expected).

Documentation

The Koha manual is maintained in Sphinx. The home page for Koha
documentation is

• Koha Documentation
  As of the date of these release notes, the Koha manual is available in the following languages:
• English (USA)
• French (83%)
• German (84%)
• Greek (91%)
• Hindi (62%)

The Git repository for the Koha manual can be found at

• Koha Git Repository

Translations

Complete or near-complete translations of the OPAC and staff
interface are available in this release for the following languages:

Partial translations are available for various other languages.

The Koha team welcomes additional translations; please see

• Koha Translation Info

For information about translating Koha, and join the koha-translate
list to volunteer:

• Koha Translate List

The most up-to-date translations can be found at:

• Koha Translation

Release Team

The release team for Koha 25.05.14 is

• Release Manager: Pedro Amorim
• Release Manager assistants:
  • Tomás Cohen Arazi
  • Martin Renvoize
• QA Manager: Lisette Scheer
• QA Team:
  • Lucas Gass
  • Laura Escamilla
  • Kyle M Hall
  • Baptiste Wojtkowski
  • Victor Grousset
  • David Cook
  • Andrew Fuerste-Henry
  • Brendan Lawlor
  • Thomas Klausner
  • Paul Derscheid
  • Jan Kissig
  • Jacob O’Mara
  • Nick Clemens
  • Tomás Cohen Arazi
  • Marcel de Rooy
  • Emily Lamancusa
  • Aleisha Amohia
  • Martin Renvoize
  • David Nind
• Topic Experts:
  • Elasticsearch/OpenSearch — Fridolin Somers
  • SIP2 — Kyle M Hall
  • EDI — Kyle M Hall
  • POS — Martin Renvoize
• Bug Wranglers:
  • Michaela Sieber
  • Laura Escamilla
• Documentation Manager: Aude Charillon
• Documentation Team:
  • Caroline Cyr La Rose
  • David Nind
  • Philip Orr
• Wiki curators:
  • Thomas Dukleth
  • George Williams
• Release Maintainers:
  • 26.05 — Lucas Gass
  • 25.11 — Baptiste Wojtkowski
  • 25.05 — Wainui Witika-Park (Catalyst IT)
  • 24.11 — Fridolin Somers
• Release Maintainer assistants:
  • 26.05 — Jacob O’Mara
  • 25.05 — Alex Buckley & Aleisha Amohia (Catalyst IT)

Credits

We thank the following libraries, companies, and other institutions who are known to have sponsored
new features in Koha 25.05.14

We thank the following individuals who contributed patches to Koha 25.05.14

We thank the following libraries, companies, and other institutions who contributed
patches to Koha 25.05.14

We also especially thank the following individuals who tested patches
for Koha

We regret any omissions. If a contributor has been inadvertently missed,
please send a patch against these release notes to koha-devel@lists.koha-community.org.

Revision control notes

The Koha project uses Git for version control. The current development
version of Koha can be retrieved by checking out the main branch of:

• Koha Git Repository

The branch for this version of Koha and future bugfixes in this release
line is 25.05.x.

Bugs and feature requests

Bug reports and feature requests can be filed at the Koha bug
tracker at:

• Koha Bugzilla

He rau ringa e oti ai.
(Many hands finish the work)

Autogenerated release notes updated last on 24 Aug 2026 03:07:51.