CVE-2026-72610
Received Received - Intake

Stored SQL Injection in Koha Library Software

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72610
EUVD
EUVD-2026-56131

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koha koha to 26.05.01 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored SQL injection flaw in Koha library software versions up to 26.05.01. Authenticated staff with specific permissions can inject SQL code into a patron's language field. The payload triggers a time-based denial of service when issue slips are printed, causing delays proportional to the injected SLEEP command.

Detection Guidance

Check Koha database logs for suspicious SQL queries or time delays during issue slip generation. Monitor patron lang field entries for unusual SQL payloads. Review Koha::AdditionalContents->search_for_display subquery execution times.

Impact Analysis

If exploited, this vulnerability can slow down or crash the Koha system when printing issue slips for affected patrons. It requires staff access but could disrupt library operations and patron services during peak usage periods.

Compliance Impact

This vulnerability may impact compliance by potentially exposing patron data through SQL injection. While data extraction is impractical due to column limits, the denial of service could violate service availability requirements in GDPR and HIPAA.

Mitigation Strategies

Upgrade Koha to a patched version beyond 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Remove or sanitize stored SQL payloads in patron lang fields. Restrict borrowers=>edit_borrowers permission to trusted staff only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart