CVE-2026-72608

Name of the Vulnerable Software and Affected Versions Koha versions 24.11.17 through 26.05.01

Description A stored SQL injection exists where authenticated staff members possessing the tools => label creator permission can execute arbitrary SQL commands. The issue occurs because the image name field of a patron card layout is stored verbatim in the layout XML and subsequently concatenated raw into a SQL query within the patroncards/create-pdf.pl script during the printing of a patron card batch. This allows an attacker to retrieve the entire database, including patron personally identifiable information (PII) and staff bcrypt password hashes, using error-based or time-based blind injection techniques.

Recommendations Update Koha to a version later than 26.05.01. Restrict the tools => label creator permission to only trusted administrative staff to minimize the risk of exploitation.