CVE-2026-8207
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Gibbon before version v30.0.01 has an SQL injection vulnerability in the Tracking/graphing feature. An authenticated user with Teacher or higher privileges can inject SQL, leading to unauthorized read/write in the database.
Risk Assessment
Risk includes database modification and potential privilege escalation.
Recommendation
Upgrade Gibbon to version v30.0.01 or later.
Other vulnerabilities in Gibbon
See all- CVE-2023-34598Critical
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- CVE-2026-8209Medium
Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.
- CVE-2026-8208High
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user-provided .zip as PHP. Successful exploitation requires Teacher or higher privileges.
- CVE-2023-34599Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- CVE-2022-27305High
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.
Original NVD description (English source)
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.