Executive brief
Gibbon, an open-source school management platform, is affected by a security flaw in how it handles file extractions. An attacker with teacher-level access or higher can exploit this to delete critical application files, leading to a total service outage. This could disrupt school operations and prevent staff and students from accessing the system until it is manually restored.
Technical details
A path traversal vulnerability (CWE-23) exists in Gibbon's file handling logic, specifically within the report archiving or ZIP extraction features. An authenticated attacker with 'Teacher' or higher privileges can provide a manipulated path to target web application PHP files. If a .zip extraction fails or is manipulated via path traversal, the application may delete the targeted files, resulting in a Denial of Service (DoS) condition. The vulnerability is mitigated by the requirement for high-level authentication (Teacher/Admin) and a high attack complexity. The issue is addressed in version v30.0.01.
Affected products
- GibbonEdu Gibbon before v30.0.01
Timeline
- 2026-02-06: patched: Version v30.0.01 released
- 2026-05-09: disclosed: CVE-2026-8209 published