PT-2026-39318 · Gibbon · Gibbon

Prjblk · Published 2026-05-09 · Updated 2026-05-11 · CVE-2026-8208

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Gibbon versions prior to v30.0.01

Description A local file inclusion issue allows remote code execution by modifying the report archive directory and forcing the system to interpret a user-provided .zip file as PHP. This requires Teacher or higher privileges and could lead to the compromise of the underlying web server.

Recommendations Update to version v30.0.01 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-8208

Affected Products

Gibbon

References · 6

• 🔥 https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#local-file-inclusionthe-next-shiny-new-thing · Exploit
• https://github.com/GibbonEdu/core/releases/tag/v30.0.01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8208 · Security Note
• https://twitter.com/CVEarity/status/2053799626629923081 · Twitter Post
• https://twitter.com/CVEnew/status/2053131398962418106 · Twitter Post
• https://t.me/CVEtracker/53194 · Telegram Post