Is there a patch available for EUVD-2026-28899?

Yes, a patch is available for EUVD-2026-28899. Update the affected software to the latest version immediately.

Gibbon EUVD-2026-28899

Q: What is the CVSS score of EUVD-2026-28899?

EUVD-2026-28899 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8209 MEDIUM

Relative Path Traversal (CWE-23)

2026-05-09 ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

GHSA-f8qc-g9ff-p4m7

PHP Path Traversal

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 09, 2026 - 05:01 EUVD

Source Code Evidence Fetched

May 09, 2026 - 04:30 vuln.today

Analysis Generated

May 09, 2026 - 04:30 vuln.today

CVE Published

May 09, 2026 - 04:16 nvd

MEDIUM 6.9

DescriptionCVE.org

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

AnalysisAI

Denial of service in Gibbon versions before v30.0.01 via path traversal during ZIP file extraction allows authenticated users with Teacher or higher privileges to trigger file deletion and application unavailability. The vulnerability exploits improper handling of malicious ZIP archives, where failed extraction attempts result in unintended deletion of PHP application files. This requires elevated privileges within the application and network access to the vulnerable endpoint.

Technical ContextAI

Gibbon is a PHP-based school management system. The vulnerability resides in ZIP file extraction functionality that fails to properly validate or sanitize file paths before extraction, violating CWE-23 (Relative Path Traversal). An attacker with Teacher or higher privileges can craft a malicious ZIP archive containing path traversal sequences (e.g., '../') that, when extracted, target and delete critical application PHP files. The failed extraction process compounds the issue by triggering deletion of the target file, resulting in denial of service rather than successful code execution. The vulnerability is specific to the ZIP extraction handler and affects the application's ability to maintain file integrity during archive operations.

RemediationAI

Upgrade immediately to Gibbon v30.0.01 or later, which includes the security patch. The vendor classifies this as a low-severity update accessible to admin users only and does not mark it as a required update, but security best practice recommends applying all patches promptly. Organizations unable to upgrade immediately should restrict Teacher-level account creation and enforce strict role-based access controls to limit who can access ZIP upload or extraction functionality. Disable or remove ZIP upload features at the application level if not essential to operations, and monitor file system changes in the Gibbon installation directory for unexpected deletion events. Additionally, implement file integrity monitoring on critical PHP application files and maintain regular backups to enable rapid recovery from accidental deletion. See https://github.com/GibbonEdu/core/releases/tag/v30.0.01 for detailed patch notes and https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#denial-of-service-via-path-traversal for technical analysis.