CVE-2026-72610: Koha Library SQL Injection Vulnerability

CVE-2026-72610 Overview

CVE-2026-72610 is a stored SQL injection vulnerability in Koha, the open-source integrated library system. The flaw affects Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff members with the borrowers => edit_borrowers permission can store a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed. The 25-character column length constrains exploitation to time-based denial of service rather than data extraction. This vulnerability maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated staff can trigger stored, time-based SQL injection that degrades availability each time an issue slip is printed for the affected patron.

Affected Products

Koha through 24.11.17
Koha through 25.05.12
Koha through 25.11.06 and 26.05.01

Discovery Timeline

2026-08-11 - CVE-2026-72610 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72610

Vulnerability Analysis

The vulnerability resides in how Koha handles patron language preferences during issue-slip generation. When staff edit a patron record, the lang field accepts input without proper sanitization or parameterization. Koha later concatenates this stored value directly into a SQL subquery inside Koha::AdditionalContents->search_for_display. The affected code path executes every time an issue slip is printed for the patron. The 25-character column limit prevents attackers from crafting payloads long enough to exfiltrate data through common techniques. However, short SLEEP() payloads fit within the limit and produce measurable timing effects. Impact scales linearly with the SLEEP value and the number of slip-news rows returned by the subquery.

Root Cause

The root cause is unsanitized string concatenation of a user-controlled patron field into a raw SQL query. The lang field is treated as trusted data after storage, bypassing the parameterized query patterns used elsewhere in Koha. This violates safe database access practices and produces a second-order injection surface.

Attack Vector

An authenticated staff account with the borrowers => edit_borrowers permission stores a SQL time-based payload in the target patron's lang field. Each subsequent print of an issue slip for that patron executes the payload against the database. Repeated slip generation multiplies the delay and can produce sustained denial of service against the library circulation workflow.

No verified public exploit code is available. See the Koha Bugzilla Report #42866 for the upstream technical discussion.

Detection Methods for CVE-2026-72610

Indicators of Compromise

Patron records where the lang field contains SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or closing parentheses and quote characters.
Unusual latency spikes in staff-client operations that print issue slips for specific patrons.
MySQL or MariaDB slow-query log entries referencing additional_contents with abnormal execution times.

Detection Strategies

Query the borrowers table for lang values that exceed expected language-code patterns such as en, fr, or es-ES.
Enable database query logging and alert on queries originating from search_for_display that include time-delay functions.
Audit Koha staff activity logs for borrowers => edit_borrowers actions that modify the lang field to non-standard values.

Monitoring Recommendations

Monitor issue-slip printing latency and correlate outliers with the patron ID being processed.
Track privilege assignments for the edit_borrowers permission and review any recent grants.
Alert on repeated slow queries against the additional_contents table originating from the Koha application user.

How to Mitigate CVE-2026-72610

Immediate Actions Required

Upgrade Koha to a fixed release above 24.11.17, 25.05.12, 25.11.06, or 26.05.01 as published by the Koha community.
Audit all patron lang field values and reset any entries that do not match expected language codes.
Restrict the borrowers => edit_borrowers permission to a minimum set of trusted staff accounts.

Patch Information

Refer to the Koha Bugzilla Report #42866 for the upstream fix status and patch references. Consult the Koha Community Homepage for the latest security release announcements and installation guidance.

Workarounds

Constrain the lang field at the application or database layer to accept only known language codes matching a strict allowlist.
Temporarily disable issue-slip printing for patrons whose lang field contains suspicious content until records are sanitized.
Apply a database-level trigger that rejects updates to borrowers.lang containing SQL metacharacters.

bash

# Configuration example: identify suspect patron lang values
mysql -u koha_user -p koha_database -e \
  "SELECT borrowernumber, lang FROM borrowers \
   WHERE lang NOT REGEXP '^[a-z]{2}(-[A-Z]{2})?$';"