# CVE-2026-8208: Gibbon local file inclusion in report archiving

Source: https://junglewise.ai/threats/cve-2026-8208-gibbon-local-file-inclusion-in-report-archiving  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-8208 · Severity: info · CVSS 8.9 · Published 2026-05-09

Gibbon, an open-source school management platform, contains a vulnerability that allows users with Teacher-level privileges or higher to execute arbitrary code on the server. By manipulating the report archive directory and uploading a specially crafted ZIP file, an attacker can bypass security checks and force the server to run malicious scripts. This could lead to a full compromise of the web server, potentially exposing sensitive student and staff data or disrupting school operations.

Technologies: [GibbonEdu Gibbon](https://junglewise.ai/threats/technologies/gibbon). Vendors: [GibbonEdu](https://junglewise.ai/threats/vendors/gibbonedu).

## Quick answers

**Is CVE-2026-8208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8208 being exploited in the wild.

**How severe is CVE-2026-8208?** Informational severity, with a CVSS score of 8.9, published 9 May 2026.

**Which products and versions are affected?** GibbonEdu Gibbon before v30.0.01.

**Is there a fix for CVE-2026-8208?** A patch was published on 2026-02-06: Version v30.0.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8208 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-8208?** Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Gibbon versions prior to v30.0.01 suffer from a local file inclusion (LFI) vulnerability in the way it handles PHP includes via index.php. While the application attempts to validate paths using the isAddressValid function—blocking '..' and the '/uploads' directory—it fails to account for the report archiving feature which allows users to redefine the archive directory. An attacker with Teacher or higher privileges can change the archive path to a location ending in '.php' and upload a ZIP file containing PHP code. Because the temporary path of the uploaded ZIP is returned to the user and the application's PHP check only requires the string '.php' to be present in the path, the attacker can include the temporary ZIP file, forcing the server to execute the embedded PHP code. This vulnerability is patched in version v30.0.01.

## Affected products

- GibbonEdu Gibbon before v30.0.01

## Timeline

- 2026-02-06: patched: Version v30.0.01 released
- 2026-05-07: disclosed: Public research blog post by Project Black published
- 2026-05-09: advisory: CVE-2026-8208 published

## References

- [https://github.com/GibbonEdu/core/releases/tag/v30.0.01](https://github.com/GibbonEdu/core/releases/tag/v30.0.01)
- [https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/](https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/)

## Related threats

- [GibbonEdu Gibbon authentication bypass in Unit Planner](https://junglewise.ai/threats/cve-2026-97864-a-vulnerability-has-been-found-in-gibbonedu-gibbon-up-to-30-0-01)
- [Gibbon path traversal and denial of service in ZIP extraction](https://junglewise.ai/threats/cve-2026-8209-gibbon-path-traversal-and-denial-of-service-in-zip-extraction)
- [Gibbon SQL injection in Tracking graphing module](https://junglewise.ai/threats/cve-2026-8207-gibbon-sql-injection-in-tracking-graphing-module)