What is the CVSS score of CVE-2026-72608?

CVE-2026-72608 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-72608?

Yes, a patch is available for CVE-2026-72608. Update the affected software to the latest version immediately.

Koha CVE-2026-72608

EUVD-2026-56129 MEDIUM

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-xg24-96fx-vx3g

SQLi Koha Koha Community

6.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects mandatory label_creator staff authentication; C:H reflects full database read access; I:N and A:N because only read exploitation is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Analysis Generated

Aug 11, 2026 - 12:29 vuln.today

DescriptionCVE.org

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.

AnalysisAI

Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.

Technical ContextAI

Koha is a widely deployed open-source integrated library system (ILS) used by public, academic, and special libraries. The vulnerable component is the patron card creator subsystem; specifically the Perl script patroncards/create-pdf.pl, which generates printable patron card PDFs from stored layout definitions. The image_name field of a patron card layout is accepted from staff input, stored verbatim in a layout XML document, and at print time is concatenated directly into a SQL query string without parameterization or escaping. This is a textbook CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) instance, specifically a stored or second-order SQL injection, where the payload is injected at layout creation time and triggered later during PDF generation. The separation between injection and execution points can defeat inline WAF rules that inspect only the current request body. The CPE string cpe:2.3:a:koha_community:koha:*:*:*:*:*:*:*:* confirms all Koha versions up to the stated thresholds are affected.

RemediationAI

Operators should upgrade to the first patched release beyond each affected branch threshold - post-24.11.17, post-25.05.12, post-25.11.06, or post-26.05.01 - as soon as the Koha community publishes corrected builds. Exact patched version numbers are not confirmed in the available data; monitor the official release channel at https://koha-community.org/ and the Bugzilla entry at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747 for release announcements. As an immediate compensating control before patching, audit and restrict the tools => label_creator permission to the smallest possible set of fully trusted staff; removing this permission from untrusted accounts eliminates the attack surface entirely but may disrupt patron card printing workflows. Additionally, review all existing patron card layouts for anomalous image_name values containing SQL metacharacters (single quotes, UNION, SELECT, SLEEP, etc.) as indicators of prior exploitation. If database activity monitoring is available, add alerting for unusual query patterns on the Koha database schema, particularly error responses or time-delay anomalies during PDF generation jobs.