CVE-2026-8207 SQL injection in gibbon
Authenticated attackers with Teacher privileges can exploit SQL injection in the Tracking feature to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8207?
CVE-2026-8207 is a high-severity SQL injection vulnerability in gibbonedu gibbon, published on 9 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.
Weakness: CWE-89
Which versions are affected by CVE-2026-8207?
How do I fix CVE-2026-8207?
No fix has been published for CVE-2026-8207 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-8207 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8207 exists.
Sources
Also known as GHSA-jhg5-9w7p-xm6m.