PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6428 Koha Community CVE debrief

CVE-2026-6428 is a SQL injection vulnerability in Koha Community Koha through various versions. An authenticated staff user with the Reports module flag can use the Filter URL parameter in reports/catalogue_out.pl to read arbitrary data from the Koha application database when the Criteria parameter matches /branchcode/. The vulnerability is due to the vulnerable sink in sub calculate concatenating the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executing it via DBI without bound parameters.

Vendor
Koha Community
Product
Koha
CVSS
MEDIUM 5.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-13
Original CVE updated
2026-08-10
Advisory published
2026-06-13
Advisory updated
2026-08-10

Who should care

Users of Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 should apply the patches to prevent SQL injection attacks.

Technical summary

The vulnerable code is in the sub calculate function where it concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters. This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions.

Defensive priority

High

Recommended defensive actions

  • Apply patches: Upgrade to Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00.
  • Restrict access to the Reports module to only trusted staff users.
  • Monitor for suspicious activity on the Koha application.

Evidence notes

The vulnerability was introduced in commit 6bb77ae3e4 (2008-07-09) and was fixed by replacing the raw concatenation with a parameterised placeholder.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6428 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6428

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6428 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6428

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://koha-community.org/security-releases/

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.