CVE-2026-72608
Description
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.
How to fix
- Koha Community Koha24.11.18, 25.05.13, 25.11.07, 26.05.02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Koha Community Koha | v < 24.11.18, 25.05.0 ≤ v < 25.05.13, 25.11.0 ≤ v < 25.11.07, 26.05.0 ≤ v < 26.05.02 | 24.11.18, 25.05.13, 25.11.07, 26.05.02 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.