CVE-2026-72608

This is a SQL injection in Koha's label creator module where the image_name field flows through XML storage into a concatenated SQL query at print-time. The attack requires the tools=>label_creator permission, which limits exploitation to authenticated library staff rather than patrons. However, treat this as insider-threat scope, not reduced severity — the vulnerability grants full database read including bcrypt password hashes and patron PII, and the affected account sits in a system that's a trust hub for interlibrary loan networks, LDAP/AD integrations, and OPAC portals. A compromised staff account pivots laterally across institutions that share patron data via ILL agreements. The CVSS 6.5 is underselling this. Permission-gated exploitation shouldn't systematically reduce scores for full database read with hash extraction — the blast radius through library integration networks far exceeds a contained impact. Assume this pattern exists elsewhere: any field in Koha's XML-stored layout configurations that flows through print-time concatenation is suspect. Check image_description, css_overrides, and similar fields in the label creator and related configuration modules. Verify your Koha version is 24.11.17, 25.05.12, 25.11.06, or 26.05.01 or later. If you're running an older release, treat this as priority remediation regardless of the nominal CVSS score — the permission boundary was documented as a mitigation but functioned as a deprioritization signal, which means this vulnerability likely persisted far longer than it should have.

Reviewed through automated stages and approved by a human before publication.