SQL Injection Vulnerability in Koha Community's Reporting Module

CVE-2026-6428

What is CVE-2026-6428?

A vulnerability exists in the reporting module of Koha Community's Koha software that allows an authenticated staff user to perform SQL injection through the 'Filter' URL parameter in reports/catalogue_out.pl. This flaw permits unauthorized access to sensitive data within the application’s database, potentially exposing critical information such as password hashes, two-factor authentication secrets, and personally identifiable information (PII). The issue stems from a lack of proper parameterization in SQL queries, allowing attackers to manipulate database queries via crafted requests. A patch has been released in several versions of Koha to mitigate this risk by implementing parameterized placeholders in the affected code.

References