CVE-2026-6428 Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
Authenticated staff users can read arbitrary database data via SQL injection in the reports module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6428?
CVE-2026-6428 is a medium-severity SQL injection vulnerability in Koha, published on 13 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Weakness: CWE-89
Which versions are affected by CVE-2026-6428?
How do I fix CVE-2026-6428?
No fix has been published for CVE-2026-6428 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-6428 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6428 exists.
Sources
Also known as GHSA-6cmj-32gf-5r49.