CVE-2026-72608: Koha SQL Injection Vulnerability

CVE-2026-72608 Overview

CVE-2026-72608 is a stored SQL injection vulnerability [CWE-89] in the Koha integrated library system. The flaw affects Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff users with the tools => label_creator permission can inject arbitrary SQL through the image_name field of a patron card layout. The injected payload persists in the layout XML and executes when a patron card batch is printed via patroncards/create-pdf.pl. Successful exploitation exposes the entire Koha database, including patron personally identifiable information (PII) and staff bcrypt password hashes.

Critical Impact
Authenticated staff attackers can exfiltrate the full Koha database, including patron PII and bcrypt-hashed staff credentials, using error-based or time-based blind SQL injection.

Affected Products

Koha through 24.11.17
Koha through 25.05.12
Koha through 25.11.06 and 26.05.01

Discovery Timeline

2026-08-11 - CVE-2026-72608 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72608

Vulnerability Analysis

The vulnerability resides in Koha's patron card creator workflow. Staff users configure patron card layouts that include an image_name value. Koha stores that value verbatim inside the layout XML without sanitization or parameter binding. When an operator later prints a patron card batch, patroncards/create-pdf.pl retrieves the stored image_name and concatenates it directly into a SQL statement. This delayed execution pattern makes the injection stored rather than reflected, so the payload fires whenever any staff member prints the poisoned batch.

Because the query runs against Koha's primary database context, an attacker can reach every table the application user can access. Practical exploitation techniques include error-based extraction and time-based blind injection, both of which succeed against the concatenated query path. Reachable data includes patron records, circulation history, and the borrowers table containing bcrypt password hashes for staff accounts.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The image_name field is neither validated on write nor parameterized on read. Koha trusts the stored layout XML as internal data, but authenticated staff can shape its contents to include SQL metacharacters and clauses.

Attack Vector

Exploitation requires an authenticated staff account holding the tools => label_creator permission. The attacker creates or edits a patron card layout and supplies a crafted image_name value containing an SQL payload. When a patron card batch using that layout is printed, patroncards/create-pdf.pl concatenates the payload into a live query. The attacker can then observe query timing or induced errors to extract database contents byte by byte.

No verified public proof-of-concept code is available. See the Koha Bug #42747 tracker for maintainer discussion and patch context.

Detection Methods for CVE-2026-72608

Indicators of Compromise

Patron card layout records whose image_name field contains SQL syntax such as single quotes, UNION, SELECT, SLEEP(, BENCHMARK(, or comment sequences.
Unexpected long-running or errored queries originating from patroncards/create-pdf.pl in Koha application or database logs.
Layout modifications performed by staff accounts that do not normally use the label creator tool.

Detection Strategies

Audit the patron card layout XML stored in the Koha database for non-filename characters in image_name values.
Enable database query logging on the Koha backend and alert on statements referencing image_name that contain SQL keywords or timing functions.
Correlate Koha staff audit logs with database error spikes to identify batch print events that trigger malformed queries.

Monitoring Recommendations

Track privilege assignments for the tools => label_creator permission and alert on new grants.
Monitor for bulk read patterns against the borrowers table outside of normal reporting windows.
Forward Koha web server, application, and MySQL or MariaDB logs to a centralized analytics platform for correlation.

How to Mitigate CVE-2026-72608

Immediate Actions Required

Upgrade Koha to a fixed release beyond 24.11.17, 25.05.12, 25.11.06, and 26.05.01 as published by the Koha community.
Review all existing patron card layouts and delete or sanitize any image_name values containing non-filename characters.
Restrict the tools => label_creator permission to a minimal set of trusted staff accounts.
Rotate staff passwords if audit logs suggest the borrowers table was queried anomalously.

Patch Information

Refer to Koha Bug #42747 for the upstream fix and coordinate with your distribution or hosting provider to apply the patched Koha release. The fix parameterizes the query in patroncards/create-pdf.pl and validates image_name on input. Additional release information is available on the Koha Community Homepage.

Workarounds

Temporarily revoke the tools => label_creator permission until the patched Koha release is deployed.
Place the Koha staff interface behind network access controls that limit exposure to trusted administrative networks.
Enforce database-level least privilege so the Koha application account cannot read tables outside its operational scope.

bash

# Configuration example: revoke label_creator permission via Koha staff interface
# Navigate to: More > Patrons > Select staff user > Set permissions
# Uncheck: tools > label_creator (Create printable labels and barcodes)
# Or via MySQL for bulk revocation:
UPDATE user_permissions
  SET code = NULL
  WHERE module = 'tools'
    AND code = 'label_creator';