CVE-2026-6428

Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

State: Published
Severity: 5.6 Medium
Published: Jun 13, 2026
Updated: Aug 10, 2026
Reserved: Apr 16, 2026

Description

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Scores

CVSS	Score	Vector	Source
4.0	5.6 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber	TuranSec
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	TuranSec
2.0	7.5 High	AV:N/AC:L/Au:S/C:C/I:N/A:P	TuranSec

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
KohaKoha Community	22.11.38 and earlierAffected 23.05.00 through 23.11.15Affected 24.05.00 through 24.11.16Affected 25.05.00 through 25.05.11Affected 25.11.00 through 25.11.05Affected 26.05.00 through 26.05.01Affected

References

Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameterissue-trackingvendor-advisory
Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)patchvendor-advisory
Koha Community Security Releasesvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.