Read the docs
TI-2026-07228 Aliases CVE-2026-8207GHSA-jhg5-9w7p-xm6m

SQL injection in gibbonedu gibbon

Priority MEDIUM 64CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed gibbon (gibbonedu): 30.0.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gibbonedugibbonbefore 30.0.0130.0.01Patch availableCNA
  • gibbon Vendorgibbonedu Affected before 30.0.01 Fixed in 30.0.01 Patch available CNA

Remediation

  • Fix · CNA gibbon (gibbonedu) Fixed in 30.0.01

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    gibbonedu gibbon — github.com/GibbonEdu/core/releases/tag/v30.0.01

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-07229 Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability…Priority MEDIUM 40
    • TI-2026-07230 Path traversal in gibbonedu gibbonPriority LOW 30
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8207
  2. 2026-10-03 Alias added: GHSA-jhg5-9w7p-xm6m

References

Exploit 1

Advisory 1

  • TI-2023-24630 GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because… CVSS 3.1CRITICAL 9.8
  • TI-2024-16254 Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side… CVSS 3.1CRITICAL 9.8
  • TI-2023-17331 Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to… CVSS 3.1CRITICAL 9.8
  • TI-2024-16255 Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization… CVSS 3.1HIGH 8.8
  • TI-2026-64279 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication CVSS 4.0MEDIUM 6.9
  • TI-2023-24632 GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report… CVSS 3.1HIGH 7.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences