CVE-2026-8208
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user-provided .zip as PHP. Successful exploitation requires Teacher or higher privileges.
Risk Assessment
Exploitation could lead to compromise of the underlying web server, giving the attacker full control over the system and data.
Recommendation
Update Gibbon to version v30.0.01 or later, which fixes this vulnerability.
Other vulnerabilities in Gibbon
See all- CVE-2023-34598Critical
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- CVE-2026-8209Medium
Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.
- CVE-2026-8207High
Gibbon before version v30.0.01 has an SQL injection vulnerability in the Tracking/graphing feature. An authenticated user with Teacher or higher privileges can inject SQL, leading to unauthorized read/write in the database.
- CVE-2023-34599Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- CVE-2022-27305High
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.
Original NVD description (English source)
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in compromise of the underlying web server.