CVE-2026-72608
MediumCVSS 6.5Summary
Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with tools => label_creator permission can execute arbitrary SQL via the image_name field of a patron card layout, allowing reading the entire database including patron PII and staff bcrypt password hashes.
Risk Assessment
An attacker can access sensitive data, including patron PII and staff password hashes, posing a serious security breach.
Recommendation
Update Koha to a fixed version. Restrict staff permissions and monitor activities.
Original NVD description (English source)
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.