CVE-2026-72610: Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->searchfordisplay when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72610?
The severity of CVE-2026-72610 is rated as medium with a score of 4.3.
How do I fix CVE-2026-72610?
To fix CVE-2026-72610, update to the latest version of Koha that addresses this vulnerability.
Who is affected by CVE-2026-72610?
CVE-2026-72610 affects authenticated staff with the borrowers => edit_borrowers permission in Koha.
What type of vulnerability is CVE-2026-72610?
CVE-2026-72610 is classified as a stored SQL injection vulnerability.
What potential impact does CVE-2026-72610 have?
The potential impact of CVE-2026-72610 includes a time-based denial of service due to malicious SQL payloads stored in the patron lang field.