CVE-2026-72608
Received Received - Intake

Stored SQL Injection in Koha Library Software

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72608
EUVD
EUVD-2026-56129

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
koha koha *
koha koha to 24.11.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored SQL injection vulnerability in Koha library software versions up to 26.05.01. An authenticated staff member with specific permissions can inject malicious SQL code via the image_name field in patron card layouts. The injected code is stored and later executed when printing patron card batches, allowing full database access including sensitive patron and staff data.

Detection Guidance

Detecting this vulnerability requires checking Koha installations for the presence of the SQL injection flaw. Review the image_name field in patron card layouts for suspicious input patterns. Check logs for unusual SQL errors or delays during patron card batch printing. Inspect the patroncards/create-pdf.pl file for raw SQL concatenation of the image_name value.

Impact Analysis

If you use affected Koha versions, an attacker with staff access could steal all patron personally identifiable information (PII) and staff password hashes. This could lead to identity theft, unauthorized system access, or further attacks on your organization's systems and users.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by exposing protected health information and personal data. Organizations may face regulatory fines, legal action, and reputational damage for failing to protect sensitive data due to this vulnerability.

Mitigation Strategies

Immediately update Koha to the latest patched version (24.11.18, 25.05.13, 25.11.07, or 26.05.02). If updating is not possible, restrict staff permissions to tools => label_creator. Sanitize the image_name field input to prevent SQL injection. Monitor database access logs for unauthorized queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart