CVE-2026-72608 Koha Community CVE debrief

Who should care

Organizations using Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 should be aware of this vulnerability. Specifically, Koha administrators, IT staff responsible for database security, and information security professionals should take note of this CVE.

Technical summary

A stored SQL injection vulnerability exists in Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. An attacker with authenticated staff privileges and the tools => label_creator permission can execute arbitrary SQL queries via the image_name field of a patron card layout. The vulnerability arises from the verbatim storage of the image_name value in the layout XML, which is later concatenated into a SQL query in patroncards/create-pdf.pl without proper sanitization. This allows for error-based or time-based blind injection, potentially enabling an attacker to read the entire Koha database, including patron Personally Identifiable Information (PII) and staff bcrypt password hashes.

Defensive priority

Authenticated staff with label_creator permission may be able to execute arbitrary SQL queries, potentially leading to unauthorized data access.

Recommended defensive actions

• Inventory and verify Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 for potential exposure.
• Restrict label_creator permission to only necessary staff.
• Monitor for suspicious database queries and error messages.
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent SQL injection attempts.
• Apply vendor remediation when available.

Evidence notes

The vulnerability exists in Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. An attacker with tools => label_creator permission can execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl. This allows for error-based or time-based blind injection, potentially enabling an attacker to read the entire Koha database, including patron PII and staff bcrypt password hashes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.