vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72608

Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

MEDIUM
6.5
CVSS Score
Published: August 11, 2026 at 11:22 AM UTC
Updated: October 24, 2026 at 03:10 PM UTC
1 product affected across 1 vendorKoha

Using Koha by Koha Community?

Get instant alerts when new vulnerabilities affect Koha - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Koha· Koha Community
90%
0 ≤ v < 24.11.1825.05.0 ≤ v < 25.05.1325.11.0 ≤ v < 25.11.0726.05.0 ≤ v < 26.05.02025.05.025.11.026.05.0
Affected range stops below 24.11.18, so it looks safe — our inference, not a vendor statement
Affected range stops below 25.05.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 25.11.07, so it looks safe — our inference, not a vendor statement
Affected range stops below 26.05.02, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Source: cverecord
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747
Source: cverecord
https://koha-community.org/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMTuranSec
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card