A path traversal flaw in Gibbon allows a user with Teacher or higher privileges to direct the application to extract PHP files from a zip archive. The extraction repeatedly fails, triggering deletion of the targeted file and ultimately causing the web application to become unavailable. The weakness is a classic directory traversal flaw (CWE‑23) and leads only to loss of availability, with no direct code execution or data disclosure.

Gibbon by GibbonEdu, versions prior to v30.0.01 are affected. The vendor is GibbonEdu and the product is Gibbon.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so the exact likelihood of exploitation in the wild is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Teacher or higher account and is carried out via a path traversal attack that deletes application files, leading to a denial‑of‑service condition. Because privileged users are required, the risk is confined to environments where such accounts are present, but once the deletion occurs the entire application cannot serve users until the missing files are restored.