CVE-2026-8208 is a local file inclusion vulnerability in the Gibbon education platform (versions prior to v30.0.01) caused by improper control of filenames in PHP include/require statements (CWE-98). This flaw allows users with Teacher or higher privileges to alter the report archive directory and trick the system into interpreting a user-provided .zip file as executable PHP code, resulting in remote code execution on the web server. The vulnerability is rated high severity with a CVSS 4.0 score of 8.9, reflecting network attack vector, high privileges required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been published yet, and no known exploitation in the wild has been documented.

Exploitation of this vulnerability can lead to remote code execution on the underlying web server, potentially allowing an attacker with Teacher or higher privileges to execute arbitrary PHP code. This could result in full compromise of the server hosting the Gibbon application, impacting confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, users should monitor the vendor's communications for updates. Until a patch is available, restrict Teacher or higher privileges to trusted users only and consider additional application-level controls to limit file upload and directory manipulation capabilities.