The vulnerability is a local file inclusion flaw that allows a teacher or higher privileged user to change the report archive directory and force the web server to treat a user‑supplied .zip file as PHP code, resulting in remote code execution on the host. This flaw directly compromises the underlying web server and any services it runs.

The affected product is Gibbon, an education management system from GibbonEdu. Versions prior to v30.0.01 are impacted. An attacker must be logged in with Teacher or higher privileges to exploit the flaw.

With a CVSS score of 8.9, the flaw is high severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated local exploit via the web interface, but once executed the attacker can run arbitrary code on the server. The lack of a publicly available exploit routine and the requirement for authenticated access lowers external exploitation probability, yet the potential impact remains critical.