Gibbon EUVD-2026-28898

Successful exploitation requires authenticated access with Teacher privilege level or higher within the Gibbon application, which represents elevated but not necessarily administrative users in typical educational deployments. The attacker must have permission to modify system configuration settings, specifically the report archive directory path setting. The vulnerability is exploitable against default Gibbon installations with no special feature enablement required, as report functionality is core to the platform. The CVSS vector AC:H (high attack complexity) reflects the multi-step process: first gaining Teacher credentials, then navigating to configuration settings, crafting a malicious ZIP with properly structured PHP payload, hosting or uploading that ZIP, modifying the archive path, and triggering the report processing that executes the inclusion. The web server must have outbound network access if the attacker uses remote ZIP hosting, or another upload vector must exist if using local file placement. These conditions significantly limit opportunistic exploitation but do not prevent targeted attacks against specific school deployments where Teacher accounts are valuable targets.

While the CVSS 8.9 score appears critical, real-world risk is substantially mitigated by the requirement for Teacher or higher privileges (PR:H), which typically represents trusted users in educational deployments. The CVSS vector shows high attack complexity (AC:H), suggesting non-trivial exploitation steps beyond simple credential compromise. Project Black Security Services published a detailed proof-of-concept walkthrough, confirming exploitability and lowering the barrier for malicious insiders or compromised teacher accounts. However, the vendor's assessment as 'low severity, accessible to admin users only' in the v30.0.01 patch release notes suggests they view this as an insider threat rather than an external attack surface concern. The vulnerability's real danger lies in privilege escalation scenarios: if an attacker first compromises a teacher account through phishing or credential stuffing, this LFI-to-RCE chain provides a path to full server compromise. The absence of EPSS data and CISA KEV listing indicates no evidence of widespread exploitation, likely because the attacker must first gain legitimate high-privilege credentials. Organizations should prioritize this based on their threat model: schools with robust access controls and monitoring for privileged accounts face lower immediate risk than those with lax teacher credential management or shared administrative passwords.

An attacker who previously compromised a teacher's credentials through a phishing campaign authenticates to the Gibbon administrative interface. They navigate to system settings controlling the report archive directory path and change it to point to a remotely accessible ZIP file they control, hosted on an external server or uploaded through another Gibbon feature. The ZIP archive contains a malicious PHP script disguised as report data. When Gibbon's reporting functionality attempts to process files from the configured archive directory, PHP's zip:// stream wrapper extracts and interprets the attacker's PHP code, executing arbitrary commands with the web server's privileges. The attacker establishes a web shell, pivots to reconnaissance of the school's network, and exfiltrates student records or plants ransomware. Project Black Security Services has published a detailed proof-of-concept demonstrating these exact steps.