CVE-2026-6428 Details

A SQL injection vulnerability has been identified in the Koha library management system, specifically in the 'reports/catalogue_out.pl' script. This issue affects Koha versions through 22.11.37, 23.x, 24.x prior to 24.11.16, 25.05.x prior to 25.05.11, 25.11.x prior to 25.11.05, 26.05.x prior to 26.05.01, and 26.11.x prior to 26.11.00. The vulnerability allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database. Exploitation occurs via the Filter URL parameter when the Criteria parameter matches 'branchcode'. The vulnerability arises because the affected code concatenates the unmodified Filter parameter directly into a SQL LIKE clause without proper sanitization or parameterization, leaving it open to injection attacks. This flaw enables error-based SQL injection, allowing attackers to extract sensitive information from various database tables, including borrower data, API keys, and session information.

Users can update to Koha versions 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00, where this vulnerability has been fixed. Instructions for updating Koha can be found on the Koha Community website.