What’s Vulnerable › Vulnerabilities

CVE-2026-6428: Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-13 · updated 2026-08-10
• Weakness: CWE-89

Description

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Affected products

• Koha Community Koha: through 22.11.38; from 23.05.00 through 23.11.15; from 24.05.00 through 24.11.16; from 25.05.00 through 25.05.11; from 25.11.00 through 25.11.05; from 26.05.00 through 26.05.01

References

• https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361
• https://koha-community.org/security-releases/

Get alerted when CVE-2026-6428 or the next vulnerability affects your stack