Gibbon EUVD-2026-28898

Upgrade immediately to Gibbon v30.0.01 or later, available at https://github.com/GibbonEdu/core/releases/tag/v30.0.01. The vendor patch addresses the improper filename control in report archive directory configuration. Note that upgrading to v30.x requires PHP 8.0+ and MySQL 8.0+ as new minimum dependencies, so infrastructure readiness should be verified before patching. While the vendor classified this as non-required low severity update, the RCE potential justifies prioritization in security-conscious environments. If immediate patching is not feasible, implement compensating controls: restrict Teacher-level and administrative account creation to verified staff only, enable multi-factor authentication for all privileged Gibbon accounts, monitor file system activity in the web server's document root for unexpected ZIP or PHP file creation, audit existing report archive directory configurations for suspicious paths pointing outside intended directories, and implement web application firewall rules to detect zip:// stream wrapper usage in HTTP parameters. These controls reduce attack surface by limiting who can authenticate with required privileges and detecting exploitation attempts, though they do not eliminate the underlying code vulnerability. Review access logs for any Teacher+ accounts that recently modified system configuration settings, particularly report-related preferences, as potential indicators of reconnaissance or exploitation attempts.