A stored SQL injection flaw exists in Koha’s patron card layout feature. The image_name field, supplied by staff with the label_creator permission, is written verbatim into an XML file and later concatenated into a SQL statement when a patron card batch is printed. The flaw enables an authenticated staff member to inject arbitrary SQL, allowing them to read the entire Koha database, including personal identifiable information and bcrypt password hashes, through error-based or time‑based blind techniques. The weakness maps to CWE‑89.

Koha Community Edition versions up to and including 24.11.17, 25.05.12, 25.11.06, and 26.05.01 are vulnerable. Only users possessing the label_creator permission are able to trigger the injection by editing a patron card layout image_name value.

The CVSS score of 6.5 indicates a moderate to high severity vulnerability with potential for significant data exposure. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known public exploitation yet. However, exploitation requires an authenticated staff user with specific permissions, making the threat more likely in environments where such privileges are misused or misassigned.