CVE-2026-72608: Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-89

Description

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.

Affected products

Koha Community Koha: before 24.11.18; from 25.05.0 before 25.05.13; from 25.11.0 before 25.11.07; from 26.05.0 before 26.05.02 — fixed in 24.11.18, 25.05.13, 25.11.07, 26.05.02

How to fix

Upgrade to a fixed version: Koha Community Koha 24.11.18, 25.05.13, 25.11.07, 26.05.02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-72608 or the next vulnerability affects your stack