CVE-2026-72610

Name of the Vulnerable Software and Affected Versions Koha versions 24.11.17 through 26.05.01

Description A stored SQL injection allows authenticated staff with the borrowers => edit borrowers permission to cause a time-based denial of service. This occurs when a SQL payload is stored in a patron lang field, which is then concatenated raw into a subquery in the search for display() function within Koha::AdditionalContents during the printing of an issue slip for the affected patron. Due to a 25-character column length limit, exploitation is restricted to timing attacks, making data extraction impractical. The payload executes every time an issue slip is printed, with the impact scaling based on the SLEEP value and the number of slip-news rows.

Recommendations Update Koha to a version later than 26.05.01. As a temporary mitigation, restrict the borrowers => edit borrowers permission to trusted personnel only.