Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
Summary
| CVE | CVE-2026-72608 |
|---|---|
| State | PUBLISHED |
| Assigner | TuranSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-11 12:17:43 UTC |
| Updated | 2026-08-11 13:19:04 UTC |
| Description | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-89 | CWE-89 CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Koha Community | Koha | affected 24.11.18 custom | Not specified |
| CNA | Koha Community | Koha | affected 25.05.0 25.05.13 custom | Not specified |
| CNA | Koha Community | Koha | affected 25.11.0 25.11.07 custom | Not specified |
| CNA | Koha Community | Koha | affected 26.05.0 26.05.02 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| koha-community.org | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | koha-community.org | |
| bugs.koha-community.org/bugzilla3/show_bug.cgi | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | bugs.koha-community.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sanjar Tulkinov Anvar ogʻli ([email protected]) (en)
There are currently no legacy QID mappings associated with this CVE.