This vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) within Koha Community software. Specifically, the image_name field of a patron card layout is stored verbatim in XML and later concatenated directly into a SQL query in patroncards/create-pdf.pl when printing patron card batches. Authenticated staff users with label_creator permission can exploit this to perform stored SQL injection attacks. The impact includes unauthorized reading of the entire Koha database, exposing patron PII and staff password hashes. The affected versions explicitly include 25.05.0, 25.11.0, and 26.05.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated staff user with specific permissions to execute arbitrary SQL commands, leading to disclosure of sensitive data such as patron personally identifiable information and staff bcrypt password hashes. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability poses a medium severity risk due to the required privileges and the nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the tools => label_creator permission to trusted staff only and monitor for suspicious activity related to patron card layout modifications. Avoid using untrusted input in the image_name field. Follow vendor updates closely for official patches or mitigations.