# CVE-2026-8209: Gibbon path traversal and denial of service in ZIP extraction

Source: https://junglewise.ai/threats/cve-2026-8209-gibbon-path-traversal-and-denial-of-service-in-zip-extraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-8209 · Severity: info · CVSS 6.9 · Published 2026-05-09

Gibbon, an open-source school management platform, is affected by a security flaw in how it handles file extractions. An attacker with teacher-level access or higher can exploit this to delete critical application files, leading to a total service outage. This could disrupt school operations and prevent staff and students from accessing the system until it is manually restored.

Technologies: [GibbonEdu Gibbon](https://junglewise.ai/threats/technologies/gibbon). Vendors: [GibbonEdu](https://junglewise.ai/threats/vendors/gibbonedu).

## Quick answers

**Is CVE-2026-8209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8209 being exploited in the wild.

**How severe is CVE-2026-8209?** Informational severity, with a CVSS score of 6.9, published 9 May 2026.

**Which products and versions are affected?** GibbonEdu Gibbon before v30.0.01.

**Is there a fix for CVE-2026-8209?** A patch was published on 2026-02-06: Version v30.0.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8209 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-8209?** Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-23) exists in Gibbon's file handling logic, specifically within the report archiving or ZIP extraction features. An authenticated attacker with 'Teacher' or higher privileges can provide a manipulated path to target web application PHP files. If a .zip extraction fails or is manipulated via path traversal, the application may delete the targeted files, resulting in a Denial of Service (DoS) condition. The vulnerability is mitigated by the requirement for high-level authentication (Teacher/Admin) and a high attack complexity. The issue is addressed in version v30.0.01.

## Affected products

- GibbonEdu Gibbon before v30.0.01

## Timeline

- 2026-02-06: patched: Version v30.0.01 released
- 2026-05-09: disclosed: CVE-2026-8209 published

## References

- [https://github.com/GibbonEdu/core/releases/tag/v30.0.01](https://github.com/GibbonEdu/core/releases/tag/v30.0.01)
- [https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/](https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/)

## Related threats

- [GibbonEdu Gibbon authentication bypass in Unit Planner](https://junglewise.ai/threats/cve-2026-97864-a-vulnerability-has-been-found-in-gibbonedu-gibbon-up-to-30-0-01)
- [Gibbon local file inclusion in report archiving](https://junglewise.ai/threats/cve-2026-8208-gibbon-local-file-inclusion-in-report-archiving)
- [Gibbon SQL injection in Tracking graphing module](https://junglewise.ai/threats/cve-2026-8207-gibbon-sql-injection-in-tracking-graphing-module)