CVE-2026-8209
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.
Risk Assessment
An attacker with teacher privileges can cause unavailability of the web application by deleting PHP files.
Recommendation
Update Gibbon to version 30.0.01 or later.
Other vulnerabilities in Gibbon
See all- CVE-2023-34598Critical
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- CVE-2026-8208High
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user-provided .zip as PHP. Successful exploitation requires Teacher or higher privileges.
- CVE-2026-8207High
Gibbon before version v30.0.01 has an SQL injection vulnerability in the Tracking/graphing feature. An authenticated user with Teacher or higher privileges can inject SQL, leading to unauthorized read/write in the database.
- CVE-2023-34599Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- CVE-2022-27305High
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.
Original NVD description (English source)
Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS