CVE-2026-72608

Executive Summary

CVE-2026-72608 is a stored SQL injection vulnerability affecting the Koha integrated library system (ILS) through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01. An authenticated staff user holding the tools => label_creator permission can execute arbitrary SQL against the Koha backend database by crafting a malicious image_name value within a patron card layout, which is later concatenated raw into a SQL query during patron card batch printing. The vulnerability enables full database exfiltration — including patron personally identifiable information (PII) and staff bcrypt password hashes — via error-based or time-based blind injection techniques, with a CVSS score of 6.5 reflecting high confidentiality impact.

Technical Analysis

The vulnerability resides in the Koha patron card management subsystem, which is part of the staff client's tools module. Specifically, the flaw exists in the patroncards/create-pdf.pl script, where an SQL query is constructed during the patron card batch printing workflow.

Vulnerability Mechanism: The attack leverages a stored XSS-to-SQLi chain through the patron card layout configuration. When a staff user with the label_creator permission creates or edits a patron card layout, the image_name field is accepted and stored verbatim — without sanitization or parameterization — into the layout XML. This stored value persists in the database as part of the layout definition.

At print time, when a patron card batch is generated, the application retrieves the layout XML and extracts the image_name value. This value is then concatenated directly into a SQL query string within patroncards/create-pdf.pl. The lack of prepared statements or parameterized queries for this particular lookup means that any SQL metacharacters embedded in the image_name field are interpreted by the database engine as part of the query, not as literal data.

Attack Surface:

• Authentication required: The attacker must be an authenticated staff user, but only needs the relatively low-privileged tools => label_creator permission.
• Privilege boundary: The permission grants access to create and manage patron card layouts, which is a legitimate administrative function but requires no elevated database privileges.
• Delivery vector: The payload is stored once and executed later (stored SQL injection), meaning the injection happens when printing operations occur — a time-delayed execution model.

Confidentiality Impact: The injection permits reading the entire Koha database contents. This includes:

• Patron PII: names, addresses, phone numbers, email addresses, library card numbers, and borrowing history.
• Staff credentials: bcrypt password hashes for staff accounts.
• System configuration data stored in the database.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability impact. The complexity is low, and no user interaction is required beyond the initial authenticated setup of the malicious layout.

Vulnerability Class: This is a classic CWE-89 (SQL Injection) instance with a stored payload. The severity is amplified by two factors: (1) the injection point is in an XML-stored configuration that may persist across system upgrades or migrations, and (2) the error-based blind injection vector means the attacker receives database error messages that disclose query structure and data fragments.

Exploitation Scenarios

The NVD description provides specific file paths and function context, but no public PoC exists at the time of writing. The attack chain is inferred from the vulnerability description and vulnerability class.

Scenario: Full Database Exfiltration via Patron Card Layout

Step 1 — Reconnaissance/Target Identification: An attacker with a valid staff account (or one who has compromised a low-privilege staff account) identifies the target Koha instance. The attacker enumerates staff permissions to confirm the tools => label_creator permission is present on the account.

Step 2 — Triggering the Flaw: The attacker navigates to the patron card layout management interface (accessed through the tools module) and creates a new patron card layout. In the image_name field, the attacker injects a crafted SQL payload. Because the field is stored verbatim into the layout XML without sanitization, the malicious payload is persisted.

A critical detail is that the image_name value is stored in the XML structure, which may require XML-encoding of special characters to survive storage and retrieval. An attacker would need to account for this, potentially using XML character entities (e.g., ", ') to encode SQL metacharacters before storage.

Step 3 — Payload Execution: When any staff user (including the attacker) generates a patron card batch for printing, patroncards/create-pdf.pl retrieves the layout and concatenates the malicious image_name value into a SQL query. The injection executes at the database layer.

For error-based injection, the attacker crafts a payload that causes the database to return verbose error messages containing queried data (e.g., using UNION SELECT or extractvalue() / updatexml() functions). For time-based blind injection, the attacker uses SLEEP() or BENCHMARK() functions to infer data character-by-character through response timing.

Step 4 — Post-Exploitation Impact: Once the attacker confirms the injection works, they can systematically extract:

• The borrowers table containing patron PII.
• The borrowers table entries containing bcrypt password hashes for staff accounts.
• Any other database table through iterative extraction.

Because the injection is blind (either error-based or time-based), the attacker may need multiple requests to extract data. Libraries running exposed Koha instances are at risk of mass PII exfiltration, potentially triggering data breach notification obligations.

No public PoC available; attack chain is inferred from vulnerability class and NVD description.

Impact Assessment

Business Impact: Koha is a widely deployed open-source integrated library system used by public, academic, school, and special libraries worldwide. A stored SQL injection in a core staff function presents severe operational and regulatory risk:

• PII Exposure: Patron records include full names, residential addresses, phone numbers, email addresses, and borrowing histories — data protected by library confidentiality laws in many jurisdictions (e.g., ALA Code of Ethics, GDPR in Europe, state library confidentiality statutes in the US).
• Credential Theft: Extraction of staff bcrypt password hashes enables offline brute-force attacks. If staff reuse passwords across systems, the compromise extends beyond Koha.
• Regulatory Consequences: Depending on jurisdiction, a breach of patron records may trigger mandatory notification requirements and fines (e.g., GDPR Article 33/34, various state breach notification laws).
• Reputational Damage: Public libraries are trusted institutions; a data breach involving patron reading habits can cause significant community trust erosion.

System Impact (CVSS Subscores):

• Attack Vector: Network — remotely exploitable over the network.
• Attack Complexity: Low — no special conditions required beyond authenticated access.
• Privileges Required: Low — the label_creator permission is not a high-privilege administrative role.
• User Interaction: None — the injection executes without victim interaction.
• Confidentiality: High — full database read access.
• Integrity: None — injection is read-focused.
• Availability: None — no denial-of-service impact.

Affected Systems: All Koha installations running versions through 24.11.17, 25.05.12, 25.11.06, or 26.05.01 are vulnerable if they have the patron card management module enabled. The attack requires the label_creator permission, meaning only instances where staff have been assigned this permission are directly exploitable; however, in many libraries this permission is granted broadly to circulation and technical services staff.

Blast Radius: The stored nature of the payload means that a single malicious layout persists until deleted. If a compromised account creates a malicious layout, any subsequent legitimate use of that layout (e.g., batch printing patron cards) triggers the injection — potentially executing even when the original attacker is not present.

Exploit Status:

• EPSS score: 0.00224 (13.1st percentile of exploited CVEs) — low probability of broad exploitation.
• CISA KEV: NO — not listed in Known Exploited Vulnerabilities.
• PoC/Exploit: UNKNOWN — no public PoC or exploit code identified.
• Nuclei Template: NO.
• No known threat actor campaigns have been identified as of this writing.

The attack's dependence on authenticated staff access reduces immediate threat likelihood, but the potential for lateral movement via harvested staff credentials elevates the overall severity in environments with weak password hygiene.

Detection Guidance

Sigma Rule

title: Koha Patron Card Layout SQL Injection - image_name Field
id: 7f3a9c2e-8b4d-4f6a-9c1e-5d8e2a4b7f31
status: experimental
description: Detects creation or modification of Koha patron card layouts containing SQL injection patterns in the image_name field
author: Valtersit Threat Intelligence
date: 2026/06/01
tags:
    - attack.t1190
    - attack.tampers
    - cve.2026-72608
logsource:
    category: application
    product: koha
    service: api
detection:
    selection_layout_save:
        event.action: 'patroncard_layout_save'
    selection_sqli_patterns:
        event.field|contains:
            - ' UNION '
            - ' SELECT '
            - ' SLEEP('
            - ' BENCHMARK('
            - ' extractvalue('
            - ' updatexml('
            - "' OR '1'='1"
            - '; DROP '
            - '--'
            - '/*'
    condition: selection_layout_save and selection_sqli_patterns
level: high
falsepositives:
    - Legitimate use of unusual text in image_name field (unlikely)
fields:
    - user.name
    - source.ip
    - event.action
    - event.field

YARA Rule

rule koha_patroncard_image_sqli {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads in Koha patron card layout image_name field (CVE-2026-72608)"
        cve = "CVE-2026-72608"
        date = "2026-06-01"
        severity = "high"
    strings:
        $s1 = "UNION SELECT"
        $s2 = "SLEEP("
        $s3 = "BENCHMARK("
        $s4 = "extractvalue("
        $s5 = "updatexml("
        $s6 = "' OR '1'='1"
        $s7 = "image_name"
        $s8 = "<image_name>"
    condition:
        uint16(0) == 0x3C3F and // XML header
        any of ($s1, $s2, $s3, $s4, $s5, $s6) and
        (any of ($s7, $s8))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-72608 - Koha Patron Card SQL Injection Attempt";
    flow:established,to_server;
    content:"patroncards"; http.uri;
    content:"image_name"; http.request_body;
    pcre:"/(UNION\s+SELECT|SLEEP\s*\(|BENCHMARK\s*\(|extractvalue\s*\(|updatexml\s*\(|OR\s+'1'\s*=\s*'1'|--|\/\*)/i";
    classtype:attempted-admin;
    reference:cve,2026-72608;
    sid:10072608;
    rev:1;
    metadata:created_at 2026_06_01, updated_at 2026_06_01;
)

Elastic Detection

// Detect Koha patron card layout modifications with SQL injection patterns
sequence by user.name with maxspan=15m
  [ any where event.action == "patroncard_layout_save" and
      process.name == "apl" or process.name == "koha" or process.name == "*koha*"
  ]
  [ any where
      (message like "*UNION SELECT*" or
       message like "*SLEEP(*" or
       message like "*BENCHMARK(*" or
       message like "*extractvalue(*" or
       message like "*updatexml(*" or
       message like "*' OR '1'='1*")
  ]

Splunk SPL Query

index=main sourcetype="koha:staff:action" 
    (action="patroncard_layout_save" OR action="patroncard_layout_edit")
    OR 
    (message="*patroncards/create-pdf.pl*" AND (error="*SQL*" OR error="*syntax*"))
    OR 
    (message="*UNION SELECT*" OR message="*SLEEP(*" OR message="*BENCHMARK(*")
| eval attack_indicator = if(match(message, "(UNION\s+SELECT|SLEEP\s*\(|BENCHMARK\s*\(|extractvalue\s*\(|updatexml\s*\(|' OR '1'='1|--|/\*)"), "true", "false")
| where attack_indicator == "true"
| table _time, user, src_ip, action, message

Wazuh OSSEC Rule

<rule id="193898" level="14">
    <if_sid>0</if_sid>
    <field name="alert.data.action">patroncard_layout_save|patroncard_layout_edit</field>
    <regex>(UNION\s+SELECT|SLEEP\s*\(|BENCHMARK\s*\(|extractvalue\s*\(|updatexml\s*\(|' OR '1'='1)</regex>
    <description>CVE-2026-72608 - Koha Patron Card SQL Injection Attempt Detected</description>
    <group>sql_injection,koha,cve-2026-72608,attack.t1190,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status: Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has not yet released fixed versions addressing this vulnerability.

Immediate Mitigations (compensating controls):

1. Restrict label_creator permission: Audit all staff accounts and remove the tools => label_creator permission from any user who does not actively create or manage patron card layouts. This reduces the attack surface.
2. Web Application Firewall (WAF) rules: Deploy WAF rules that inspect POST requests to Koha API endpoints and block requests containing SQL injection patterns in form fields, particularly fields associated with patron card layout configuration. The Suricata rule above can serve as a reference.
3. Database-level protections: Configure the Koha database user with least-privilege access. If the application database account lacks SELECT on system tables (e.g., mysql.user, pg_authid), the attacker's visibility is limited.
4. Monitor layout modifications: Enable audit logging for patron card layout creation/editing. Investigate any unexpected modifications, particularly those originating from accounts not normally performing this function.
5. Database activity monitoring: Deploy database audit tools (e.g., pgAudit for PostgreSQL, audit plugin for MySQL) to detect anomalous SQL queries containing UNION SELECT, SLEEP(), or extractvalue() patterns originating from the Koha application user.

Patch/Upgrade Steps:

1. Monitor the Koha community release channels (koha-community.org, Koha mailing lists, Git repository) for patched versions.
2. When a patch is released, apply the vendor-recommended upgrade to the latest affected branch (24.11.x, 25.05.x, 25.11.x, or 26.05.x).
3. Test the patch in a staging environment before production deployment.
4. The fix should address the SQL query in patroncards/create-pdf.pl by parameterizing the query or sanitizing/validating the image_name value before SQL construction.

Long-Term Hardening:

1. Input validation: Implement server-side validation of all layout fields, particularly image_name, to reject SQL metacharacters (single quotes, semicolons, comment markers).
2. Parameterized queries: Advocate for a code audit of all Perl CGI scripts in Koha to identify and remediate other instances of raw SQL concatenation.
3. Least privilege: Enforce strict role-based access control for all staff tools. The label_creator permission should not be included in default staff role templates.
4. Credential hygiene: Enforce strong password policies for staff accounts and implement multi-factor authentication for the Koha staff client. The exposure of bcrypt hashes is only mitigated by strong password selection.
5. Database network isolation: Ensure the Koha application and database servers are on separate network segments with strict firewall rules.
6. Backup and recovery: Maintain offline backups to recover from any data corruption or destruction scenario.
7. Security awareness: Train staff on phishing risks — a compromised low-privilege staff account is the primary entry vector for this vulnerability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72608
2. Koha Community: https://koha-community.org/ (Official project site — monitor for security advisory)
3. CWE-89 SQL Injection: https://cwe.mitre.org/data/definitions/89.html
4. Koha Git Repository: https://git.koha-community.org/ (Monitor for patch commits)
5. CISA KEV Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Intelligence:

• No known threat actor campaigns have been identified targeting this CVE as of the reporting date.
• EPSS score of 0.00224 (13.1st percentile) indicates a low probability of widespread exploitation in the near term.
• The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
• The requirement for authenticated staff access with a specific permission reduces the likelihood of opportunistic scanning-based exploitation; however, targeted attacks against libraries (particularly those in politically sensitive regions or those with high-profile collections) remain plausible.

Disclaimer: This report is based on the NVD description and publicly available vulnerability data at the time of writing. The Koha security team has not yet published an advisory — version numbers and affected branches are derived solely from the NVD description. Insufficient technical detail is available regarding the exact SQL query structure or the precise XML schema; the attack chain is inferred from the vulnerability description.