CVE-2026-72608 in Koha
Summary
by MITRE • 08/11/2026
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical stored sql injection flaw in the koha integrated library system affecting multiple version ranges including 24.11.17, 25.05.12, 25.11.06, and 26.05.01. The issue stems from insufficient input validation and sanitization within the patron card layout functionality where the image_name field value is stored verbatim in xml format without proper escaping or encoding. When administrators with the tools => label_creator permission create or modify patron card layouts, the maliciously crafted image_name values are persistently stored in the database. The vulnerability manifests during the pdf generation process in the patroncards/create-pdf.pl script where these stored values are directly concatenated into sql queries without proper parameterization or sanitization. This design pattern creates a classic stored sql injection vector that allows authenticated attackers to execute arbitrary sql commands against the underlying database system. The impact extends beyond simple data retrieval as attackers can leverage error-based or time-based blind sql injection techniques to extract complete database contents including sensitive patron personally identifiable information and staff credentials stored as bcrypt password hashes.
The technical exploitation of this vulnerability follows a well-established pattern that aligns with common weakness enumeration cw 89 and attack technique t1070 in the mitre att&ck framework. Attackers require only a valid staff account possessing the specific tools => label_creator permission to initiate the attack, making this vector particularly dangerous in environments where staff accounts may be compromised or where privilege escalation occurs through other means. The stored nature of the injection means that once a malicious payload is injected into the image_name field, it persists and executes every time the affected pdf generation process runs, potentially affecting multiple users without additional authentication requirements. This vulnerability demonstrates poor input validation practices and highlights the importance of proper sql query construction methodologies including parameterized queries or proper escaping mechanisms. The attack surface encompasses the complete koha database schema with potential access to patron records, staff credentials, system configurations, and other sensitive institutional data.
Organizations utilizing koha systems should immediately implement several defensive measures to mitigate this vulnerability. The most effective immediate mitigation involves applying the latest security patches provided by the koha development team as these versions contain proper input sanitization and parameterized query implementations. System administrators should also implement network segmentation and access controls to limit staff account exposure, particularly restricting the tools => label_creator permission to only essential personnel. Database monitoring solutions should be configured to detect unusual sql query patterns or unauthorized data access attempts that might indicate exploitation activities. Additionally, organizations should conduct comprehensive security audits of their koha installations to identify any other potential injection vectors within the system, as this vulnerability may indicate broader input validation weaknesses in the application architecture. Regular penetration testing and vulnerability assessments should be implemented to verify that all sql injection vulnerabilities have been properly addressed and to prevent similar issues from emerging in other components of the library management system.