CVE-2026-72610 | Koha Community up to 24.11.17/25.05.12/25.11.6/26.05.1 Patron Lang Field AdditionalContents->search_for_display lang sql injection

A vulnerability, which was classified as critical, was found in Koha Community Koha up to 24.11.17/25.05.12/25.11.6/26.05.1. This affects the function Koha::AdditionalContents->search_for_display of the component Patron Lang Field. Such manipulation of the argument lang leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-72610. The attack can be launched remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More