This vulnerability (CWE-89) allows authenticated staff members with specific permissions in Koha Community versions 25.05.0, 25.11.0, and 26.05.0 to store a SQL injection payload in a patron language field. The payload is concatenated without proper neutralization into a subquery within Koha::AdditionalContents->search_for_display during issue slip printing. Due to the 25-character limit on the column, exploitation is restricted to time-based denial of service attacks rather than data extraction. Each time an issue slip is printed for the affected patron, the stored payload executes, causing delays that scale linearly with the injected SLEEP value and the number of slip-news rows.

The vulnerability enables a time-based denial of service attack that can degrade system performance when issue slips are printed for affected patrons. There is no confidentiality or integrity impact reported, and data extraction is not practical due to input length constraints. The attack requires authenticated staff privileges with the borrowers => edit_borrowers permission.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict or review staff permissions to limit who can edit borrower information, especially the language field. Monitor for unusual delays during issue slip printing as a potential indicator of exploitation.