CVE-2026-8208: Gibbon LMS RCE Vulnerability via LFI

CVE-2026-8208 Overview

CVE-2026-8208 is a local file inclusion (LFI) vulnerability in Gibbon, an open-source school management platform, affecting versions before v30.0.01. Attackers with Teacher or higher privileges can modify the report archive directory and force the application to interpret a user-supplied .zip file as PHP. This results in remote code execution on the underlying web server. The flaw is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. Successful exploitation grants the attacker code execution in the context of the PHP process, which can lead to full server compromise.

Critical Impact

Authenticated attackers can achieve remote code execution on Gibbon servers by abusing the report archive directory configuration to load attacker-controlled PHP content.

Affected Products

• Gibbon (GibbonEdu/core) versions before v30.0.01
• Deployments where Teacher or higher accounts are issued to users
• PHP-based Gibbon installations running on standard web servers

Discovery Timeline

• 2026-05-09 - CVE-2026-8208 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8208

Vulnerability Analysis

The vulnerability is a classic PHP file inclusion weakness mapped to CWE-98. Gibbon allows authenticated users with Teacher or higher privileges to influence the report archive directory setting. An attacker can repoint this directory to a location containing an attacker-uploaded .zip file. The application then includes or interprets the file through PHP, executing arbitrary code embedded inside the archive payload.

Because the include path is user-influenced and the file extension check does not prevent PHP interpretation, the PHP engine evaluates attacker-controlled content. The result is arbitrary code execution under the web server user. Technical analysis published in the Project Black blog walks through the local file inclusion chain in detail.

Root Cause

The root cause is improper validation of the report archive directory path combined with PHP's behavior of executing any included file as code regardless of extension. Gibbon trusts privileged users to set safe directory values, but does not constrain the path or sanitize the file content before inclusion. This trust boundary mistake turns a configuration option into an inclusion sink.

Attack Vector

An authenticated user with Teacher or higher privileges uploads a .zip archive containing PHP code to a writable location. The attacker then changes the report archive directory to point to the upload path. When Gibbon includes the staged file, PHP parses the embedded code, granting the attacker command execution on the web server.

No verified exploit code is publicly available. Refer to the Project Black research write-up for the technical exploitation chain.

Detection Methods for CVE-2026-8208

Indicators of Compromise

• Unexpected modifications to the Gibbon report archive directory configuration value
• .zip files uploaded by Teacher-level accounts that contain PHP tags or webshell payloads
• New or unfamiliar PHP processes spawning shells (/bin/sh, bash, cmd.exe) from the Gibbon web root
• Outbound network connections from the web server process to unknown hosts following report archive activity

Detection Strategies

• Hunt for include, require, or fopen calls in Gibbon logs referencing paths outside the default archive directory
• Inspect uploaded archives for <?php markers or obfuscated PHP payloads before extraction
• Correlate audit events showing report archive directory changes with subsequent file access on the web server
• Monitor for child processes of php-fpm or Apache that execute shell utilities or reconnaissance commands

Monitoring Recommendations

• Enable file integrity monitoring (FIM) on the Gibbon installation directory and configuration store
• Forward web server, PHP, and Gibbon application logs to a centralized analytics platform for correlation
• Alert on privilege changes that elevate accounts to Teacher or higher roles in unusual patterns
• Track HTTP requests to report generation and archive endpoints for anomalous parameter values

How to Mitigate CVE-2026-8208

Immediate Actions Required

• Upgrade Gibbon to v30.0.01 or later using the official GitHub release
• Audit all Teacher and higher privileged accounts and revoke unused or suspicious access
• Inspect the current report archive directory setting and reset it to a known safe path
• Review web server file systems for unauthorized .zip or PHP files placed in upload directories

Patch Information

The Gibbon maintainers released version v30.0.01 to address CVE-2026-8208. Administrators should apply the upgrade from the GibbonEdu/core release page. The patch constrains the report archive directory handling so attacker-controlled paths cannot be used to include arbitrary PHP content.

Workarounds

• Restrict Teacher and administrative role assignments until the upgrade is applied
• Configure the web server to deny PHP execution within upload and archive directories using rules such as php_admin_flag engine off in Apache or equivalent location blocks in Nginx
• Apply file system permissions that prevent the web server user from writing to directories that PHP can include
• Place the Gibbon application behind a web application firewall (WAF) with rules blocking file inclusion patterns

# Apache configuration example to disable PHP execution in archive uploads
<Directory "/var/www/gibbon/uploads">
    php_admin_flag engine off
    Options -ExecCGI
    AllowOverride None
</Directory>