Executive brief
Koha is an open-source library management system used by libraries to manage patron accounts, circulation, and library operations. A vulnerability allows staff members with patron-editing permissions to inject malicious SQL code into a patron's language field, which executes when issue slips (receipts) are printed. While the column length limits practical exploitation to denial-of-service attacks via database delays, repeated slip printing can measurably slow library operations.
Technical details
A stored SQL injection vulnerability exists in Koha::AdditionalContents::search_for_display (AdditionalContents.pm lines 96–106), where the patron's lang field is concatenated directly into a SQL subquery without parameterization or escaping. An authenticated staff member with borrowers::edit_borrowers permission can inject SQL via members/memberentry.pl or the REST API (PUT /api/v1/patrons/{id}). The payload is stored in the borrowers.lang column (varchar(25)) and executes when an issue slip is printed for that patron, triggering C4/Members.pm IssueSlip. The 25-character limit prevents data extraction; impact is limited to time-based denial of service using SLEEP(). Patches available in Koha 26.11.00, 26.05.02, 25.11.07, 25.05.13, and 24.11.18.
Affected products
- Koha Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01
Timeline
- 2026-08-11: disclosed: CVE-2026-72610 published
- 2026-09-03: patched: Fixed in Koha 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18