Read the docs
TI-2026-07230 Aliases CVE-2026-8209GHSA-f8qc-g9ff-p4m7

Path traversal in gibbonedu gibbon

Priority LOW 30CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.

Summary

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed gibbon (gibbonedu): 30.0.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gibbonedugibbonbefore 30.0.0130.0.01Patch availableCNA
  • gibbon Vendorgibbonedu Affected before 30.0.01 Fixed in 30.0.01 Patch available CNA

Remediation

  • Fix · CNA gibbon (gibbonedu) Fixed in 30.0.01

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    gibbonedu gibbon — github.com/GibbonEdu/core/releases/tag/v30.0.01

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-07228 SQL injection in gibbonedu gibbonPriority MEDIUM 64
    • TI-2026-07229 Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability…Priority MEDIUM 40
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8209
  2. 2026-10-03 Alias added: GHSA-f8qc-g9ff-p4m7

References

Exploit 1

Advisory 1

  • TI-2023-24630 GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because… CVSS 3.1CRITICAL 9.8
  • TI-2024-16254 Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side… CVSS 3.1CRITICAL 9.8
  • TI-2023-17331 Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to… CVSS 3.1CRITICAL 9.8
  • TI-2024-16255 Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization… CVSS 3.1HIGH 8.8
  • TI-2026-64279 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication CVSS 4.0MEDIUM 6.9
  • TI-2023-24632 GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report… CVSS 3.1HIGH 7.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences