Gibbon CVE-2026-8209

Successful exploitation requires authentication as a user with Teacher role or higher privilege level within Gibbon. The attacker must have access to upload or trigger ZIP file extraction functionality available to Teacher accounts. The vulnerability does not require any special non-default configuration - it affects standard Gibbon installations where Teacher upload or archive handling features are enabled. No public user interaction beyond uploading the malicious ZIP is required. The limiting factors are: (1) authentication with Teacher or higher privilege is mandatory, (2) the vulnerable ZIP extraction functionality must be accessible to that role, and (3) the application must attempt extraction of the attacker-controlled archive. This is not exploitable by unauthenticated users, anonymous accounts, or users with Student or lower-tier roles.

CVSS 6.9 with attack vector Network, high complexity, and high privilege requirement reflects a medium-impact vulnerability with significant barriers to exploitation. The CVSS vector (AV:N/AC:H/PR:H/UI:N) indicates remote network access is possible, but attack complexity is high and requires privileged authentication (Teacher role minimum). The availability impact is rated high (VA:H), confirming denial of service as a real consequence. The privilege requirement (PR:H) is the critical limiting factor - this is not an unauthenticated or low-privilege attack. The vulnerability does not provide confidentiality or integrity compromise directly; impact is strictly availability. Risk is moderate in organizations where Teacher accounts are widely distributed, but substantially lower in institutions with tight RBAC enforcement. No public exploit code or CISA KEV status is indicated, suggesting limited real-world exploitation pressure. The combination of elevated privilege requirement, high attack complexity, and lack of active exploitation signals this is a real but lower-priority vulnerability compared to unauthenticated remote code execution.

A Teacher-level user (or attacker with compromised Teacher credentials) logs into the Gibbon web application and uploads a specially crafted ZIP archive containing path traversal sequences such as '../../../' targeting core PHP application files. Upon the application attempting to extract the archive, the malformed paths cause extraction failure, which triggers automatic deletion of the targeted PHP files, rendering the application unavailable to other users and requiring administrative intervention to restore from backup or reinstall.