Is there a patch available for CVE-2026-6428?

Yes, a patch is available for CVE-2026-6428. Update the affected software to the latest version immediately.

Koha CVE-2026-6428

Q: What is the CVSS score of CVE-2026-6428?

CVE-2026-6428 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-36652 MEDIUM

SQL Injection (CWE-89)

2026-06-13 TuranSec

GHSA-6cmj-32gf-5r49

SQLi Koha Koha Community

5.6

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber

vuln.today AI

6.5 MEDIUM

Network-reachable via authenticated staff web session (PR:L); read-only SQL injection yields full confidentiality loss with no confirmed integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 13, 2026 - 17:31 vuln.today

DescriptionCVE.org

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters:

my $f = @$filters[0]; $f =~ s/\*/%/g; $strsth2 .= " AND $column LIKE '$f' ";

This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions.

Proof of concept (error-based, single request):

GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+- Cookie: CGISESSID=<LIBRARIAN_SESSION>

The response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...).

The vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.

AnalysisAI

SQL injection in Koha's reports/catalogue_out.pl grants authenticated staff with the Reports module flag full read access to the Koha MariaDB database, including borrower password hashes, 2FA secrets, API keys, session tokens, and patron PII. The vulnerability traces to a 2008 commit and was overlooked when CVE-2015-4633 patched the same injection class in sibling files. A working single-request proof-of-concept using EXTRACTVALUE error-based extraction has been publicly disclosed; no CISA KEV listing has been confirmed at time of analysis, but the low exploitation barrier for credentialed staff makes this a high-priority remediation.

Technical ContextAI

Koha is an open-source integrated library system (ILS) built on Perl/CGI. The vulnerable component is reports/catalogue_out.pl, specifically the calculate subroutine, which constructs a dynamic SQL LIKE clause by interpolating the raw Filter HTTP parameter directly into a string that is then executed via Perl's DBI interface without bound parameters. The root cause (CWE-89: SQL Injection) is classic unsanitized string concatenation ('AND $column LIKE \'$f\'') rather than the parameterized placeholder ($sth->execute(..., $f)) that DBI provides. The injection is guarded by a Criteria regex check (/branchcode/), but this parameter is fully attacker-controlled. The underlying database is MariaDB. Affected CPE: cpe:2.3:a:koha_community:koha:*:*:*:*:*:*:*:*. The vulnerability was introduced in commit 6bb77ae3e4 (2008-07-09) and survived the incomplete CVE-2015-4633 remediation pass, which targeted sibling reports files but not this specific endpoint.

RemediationAI

Upgrade to a vendor-released patched version: Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00, all of which replace the raw string-concatenation sink in reports/catalogue_out.pl with DBI parameterized placeholders. The patch is available at https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539 and release announcements are at https://koha-community.org/security-releases/. If immediate upgrade is not feasible, remove the Reports module flag from all staff accounts that do not operationally require it, eliminating the authentication surface needed for exploitation; this has no effect on other Koha functions. As an additional short-term compensating control, deploy a WAF rule blocking requests to /cgi-bin/koha/reports/catalogue_out.pl whose Filter parameter contains SQL metacharacters (single quotes, EXTRACTVALUE, CONCAT, SUBSTRING); note this may produce false positives for patrons with apostrophes in branch names. Network-layer controls are insufficient because exploitation uses the standard authenticated web session. Audit staff accounts granted the Reports module flag as part of post-remediation hygiene.