Stored SQL Injection in Koha Affects Library Management Systems

CVE-2026-72607

What is CVE-2026-72607?

A stored SQL injection vulnerability exists in Koha versions up to 26.05.01 that enables authenticated users with specific permissions to execute arbitrary SQL queries. By injecting a SQL payload into the agefield value of item modification rules, an attacker can manipulate database queries executed during cron jobs, thereby gaining unauthorized access to sensitive information such as patron personally identifiable information (PII) and staff password hashes. The vulnerability primarily affects databases running on MariaDB/MySQL, allowing attackers to execute SELECT queries and craft time-based SLEEP payloads.

References