Vulnerability · Published Jun 13, 2026 · Assigned by TuranSec

CVE-2026-6428Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

High 7.6

In plain English

A high-severity SQL injection in Koha from Koha Community. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Affected products (as reported)

Vendor	Product	Versions
Koha Community	Koha	0 – through 22.11.3823.05.00 – through 23.11.1524.05.00 – through 24.11.1625.05.00 – through 25.05.1125.11.00 – through 25.11.0526.05.00 – through 26.05.01

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter issue-tracking, vendor-advisory
Bug 42361: Fix SQL injection in catalogue_out.pl (official patch) patch, vendor-advisory
Koha Community Security Releases vendor-advisory