Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-8209
PUBLISHED
More InfoOfficial Page
Assigner-PRJBLK
Assigner Org ID-ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a
View Known Exploited Vulnerability (KEV) details
Published At-09 May, 2026 | 03:19
Updated At-09 May, 2026 | 03:19
Rejected At-
▼CVE Numbering Authority (CNA)

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

Affected Products
Vendor
gibbonedu
Product
gibbon
Default Status
unaffected
Versions
Affected
  • From 0 before 30.0.01 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-23CWE-23 Relative path traversal
Type: CWE
CWE ID: CWE-23
Description: CWE-23 Relative path traversal
Metrics
VersionBase scoreBase severityVector
4.06.9MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Version: 4.0
Base score: 6.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-126CAPEC-126 Path Traversal
CAPEC ID: CAPEC-126
Description: CAPEC-126 Path Traversal
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/GibbonEdu/core/releases/tag/v30.0.01
vendor-advisory
https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#denial-of-service-via-path-traversal
exploit
Hyperlink: https://github.com/GibbonEdu/core/releases/tag/v30.0.01
Resource:
vendor-advisory
Hyperlink: https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#denial-of-service-via-path-traversal
Resource:
exploit
Details not found