PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8208 Projectblack CVE debrief

CVE-2026-8208 is a high-severity issue in Gibbon versions before v30.0.01. According to the supplied record, an attacker with Teacher or higher privileges can change the report archive directory and force a user-provided .zip file to be interpreted as PHP, which can lead to remote code execution and compromise of the underlying web server.

Vendor
Projectblack
Product
Unknown
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Administrators of Gibbon deployments, especially schools or organizations that grant Teacher-level or higher accounts, should treat this as a priority remediation item. Security teams should also review any environment where Gibbon is internet-facing or where privileged non-admin roles can manage report archives.

Technical summary

The vulnerability is described as a local file inclusion condition that can be chained into RCE. The supplied CVE record says exploitation requires Teacher or higher privileges and involves changing the report archive directory so a user-provided .zip is interpreted as PHP. The CVE is associated with CWE-98 and is fixed in Gibbon v30.0.01 per the referenced release tag.

Defensive priority

High — authenticated RCE risk with potential web server compromise, but exploitation requires Teacher or higher privileges.

Recommended defensive actions

  • Upgrade Gibbon to v30.0.01 or later.
  • Review which accounts have Teacher or higher privileges and remove unnecessary access.
  • Audit report archive directory handling and related file-processing paths for unexpected changes.
  • Check web server and application logs for suspicious archive-directory modifications or abnormal file interpretation behavior.
  • If exposure is suspected, assess the host for signs of compromise and rotate credentials as appropriate.

Evidence notes

This debrief is based on the supplied NVD record for CVE-2026-8208, which lists the vulnerability description, CWE-98, and references to the Gibbon v30.0.01 release tag and a ProjectBlack analysis article. The vendor field in the supplied corpus is low-confidence and marked needsReview, so the product name should be interpreted from the CVE content and references rather than the vendor metadata alone.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8208 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8208

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8208 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8208

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/GibbonEdu/core/releases/tag/v30.0.01

    ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

  • Source reference

    Unverified legacy reference

    URL: https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/

    ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.