CVE-2026-6428: Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
SQL Injection in reports/catalogueout.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 22.11.38 - Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 24.11.16 - Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 25.05.11 - Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 25.11.05 - Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 26.05.01 - Upgrade
Upgrade
Koha reports/catalogue_out.plto a version that resolves this vulnerability.Fixed in 26.11.00 - Compensating control
Restrict the Reports module flag / access to the Reports UI so only trusted authenticated staff users can access reports/catalogue_out.pl with the Filter parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6428?
CVE-2026-6428 has a severity rating of high at 7.6.
What kind of vulnerability is CVE-2026-6428?
CVE-2026-6428 is an SQL Injection vulnerability in the Koha Community software.
How can an attacker exploit CVE-2026-6428?
An attacker can exploit CVE-2026-6428 by using an authenticated staff account with the Reports module enabled to read arbitrary data.
How do I fix CVE-2026-6428?
To mitigate CVE-2026-6428, you should upgrade to Koha versions 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00 or higher.
Who is affected by CVE-2026-6428?
CVE-2026-6428 affects authenticated staff users of Koha Community Koha software versions listed in the vulnerability details.