SQL Injection in Koha Community
CVE-2026-6428
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.002 (15.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.002 · change: -0.001
Affected products
- Koha Community — versions 0, 23.05.00, 24.05.00
Weakness classification (CWE)
References
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (vendor-advisory, patch)
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (issue-tracking, vendor-advisory)
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (vendor-advisory)
Frequently asked questions
- What is CVE-2026-6428?
- CVE-2026-6428 is a high-severity vulnerability in Koha Community, classified under SQL Injection. CVSS score: 7.6/10. Published 2026-06-13.
- How severe is CVE-2026-6428?
- High severity. CVSS v3 base score is 7.6 out of 10.