Executive brief
Gibbon, an open-source school management platform, contains a vulnerability that allows users with Teacher-level privileges or higher to execute arbitrary code on the server. By manipulating the report archive directory and uploading a specially crafted ZIP file, an attacker can bypass security checks and force the server to run malicious scripts. This could lead to a full compromise of the web server, potentially exposing sensitive student and staff data or disrupting school operations.
Technical details
Gibbon versions prior to v30.0.01 suffer from a local file inclusion (LFI) vulnerability in the way it handles PHP includes via index.php. While the application attempts to validate paths using the isAddressValid function—blocking '..' and the '/uploads' directory—it fails to account for the report archiving feature which allows users to redefine the archive directory. An attacker with Teacher or higher privileges can change the archive path to a location ending in '.php' and upload a ZIP file containing PHP code. Because the temporary path of the uploaded ZIP is returned to the user and the application's PHP check only requires the string '.php' to be present in the path, the attacker can include the temporary ZIP file, forcing the server to execute the embedded PHP code. This vulnerability is patched in version v30.0.01.
Affected products
- GibbonEdu Gibbon before v30.0.01
Timeline
- 2026-02-06: patched: Version v30.0.01 released
- 2026-05-07: disclosed: Public research blog post by Project Black published
- 2026-05-09: advisory: CVE-2026-8208 published