shouldiuse.io

Categories

VERDICT

Gibbon Review

Depends

Should I use Gibbon?

Gibbon is a flexible, open source school management platform designed to make life better for teachers, students, parents and leaders. - gibbonedu.org

· 1 month ago

Schools with their own IT staff get a genuinely free, full-featured school platform — if they commit to fast security patching. Small schools, tutoring outfits, and anyone wanting vendor-hosted support should look elsewhere.

Confidence

Medium. Based on 15 public sources; user reviews are thin — most 'Gibbon' hits are unrelated products (slacklines, speakers, apes).

Ratings

  • Value for money
  • Ease of useNo usability evidence in sources
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Community (self-hosted)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Schools with in-house IT
  • Budget-constrained schools wanting a full SIS
  • Open-source-friendly admin teams

Not for

  • Schools without a sysadmin — the CVE history demands fast patching
  • Tutoring or small teams needing just a gradebook
  • Buyers who need vendor support and SLAs
  • Anyone expecting polished hosted onboarding

Gotchas - check before you buy

high

Self-hosted: you provision hosting, run upgrades, and must patch fast when RCEs land

high

CVE-2026-8207 SQL injection affects versions before v30.0.0 — verify currency before deploying

medium

Free core, but budget for hosting, migration, and admin time; no vendor tiers published

medium

Security info lives in a community forum category, not a proper security page

Pros and cons

Pros

  • Free and open source — no license fees
  • Broad school modules, including finance
  • Active community of users, admins, developers
  • Publishes security advisories on GitHub
  • Tracked on G2, Capterra, and AWS Marketplace

Cons

  • Repeated serious CVEs: RCE, SQL injection, file inclusion
  • No security page found on the official site
  • Open source means hosting, updates, backups are on you
  • No published vendor pricing or hosted tiers

Sources & method

- 15 sources - Rough record: multiple RCE, SQL injection, and file-inclusion CVEs between 2023 and 2026; patching discipline is mandatory.

official x4review x4security x7
  • CVE-2026-8208 — RCE via local file inclusion, Gibbon LMS local file inclusion leading to remote code execution.
  • CVE-2026-8207 — SQL injection, Affects Gibbon versions before v30.0.0.
  • CVE-2024-24724 — remote code execution, RCE vulnerability in Gibbonedu Gibbon.
  • CVE-2024-24725 — PHP deserialization, Deserialization vulnerability exploited in Gibbon LMS.
  • CVE-2023-34598 — local file inclusion, Gibbon v25.0.0 vulnerable to LFI.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 15

    Sources

  • Analyzed

  • Value for money: 5/5. Free, open source; no license fees
  • Ease of use. No usability evidence in sources
  • Feature depth: 4/5. Full school platform including finance module
  • Support quality: 2/5. Guess: community forum support, no vendor SLA
  • Security posture: 1/5. Six-plus CVEs 2023–2026, including RCEs
  • Free Starting price Open source, self-hosted
  • 6+ Public CVEs found 2023–2026, incl. RCE and SQLi
  • 10 G2 alternatives tracked Competing school platforms

Pricing

Community (self-hosted)

Free

  • Full open-source school platform
  • You host, maintain, and patch

Security

Rough record: multiple RCE, SQL injection, and file-inclusion CVEs between 2023 and 2026; patching discipline is mandatory.

  • CVE-2026-8208 — RCE via local file inclusionGibbon LMS local file inclusion leading to remote code execution.⁹
  • CVE-2026-8207 — SQL injectionAffects Gibbon versions before v30.0.0.10
  • CVE-2024-24724 — remote code executionRCE vulnerability in Gibbonedu Gibbon.11
  • CVE-2024-24725 — PHP deserializationDeserialization vulnerability exploited in Gibbon LMS.12
  • CVE-2023-34598 — local file inclusionGibbon v25.0.0 vulnerable to LFI.13

What users say

No substantive user reviews of the school platform surfaced; most 'Gibbon' search results concern unrelated products like slacklines and speakers.

Full analysis

Based on 15 public sources; user reviews are thin — most 'Gibbon' hits are unrelated products (slacklines, speakers, apes).

Free open-source school platform; real value if you have IT staff, but a rough CVE record means patch fast.

Methodology

Based on 15 public sources; user reviews are thin — most 'Gibbon' hits are unrelated products (slacklines, speakers, apes).

Read how a report is made.

Sources

  1. Gibbon — The Flexible School Platform (official)gibbonedu.org
    official
  2. Gibbon Finance feature (official)gibbonedu.org
    official
  3. Gibbon Security page (not found)gibbonedu.org
    official
  4. Gibbon Support Forum — Security categoryask.gibbonedu.org
    official
  5. Gibbon Reviews — G2g2.com
    review
  6. Top 10 Gibbon Alternatives & Competitors — G2g2.com
    review
  7. Gibbon Reviews — AWS Marketplaceaws.amazon.com
    review
  8. Gibbon Software Pricing — Capterracapterra.com
    review
  9. CVE-2026-8208 — Gibbon LMS RCE via LFIsentinelone.com
    security
  10. CVE-2026-8207 — Gibbon SQL Injectioncvefeed.io
    security
  11. CVE-2024-24724 — Gibbon RCEsentinelone.com
    security
  12. CVE-2024-24725 — PHP Deserialization in Gibbon LMSblog.secondx.io
    security
  13. CVE-2023-34598 — Gibbon v25.0.0 LFIgithub.com
    security
  14. CVE-2023-45878 — GibbonEdu v25.0.00 (NVD)nvd.nist.gov
    security
  15. Session Vulnerability in Gibbon Core (GHSA)github.com
    security

Add this review to your site

This check for Gibbon says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Gibbon Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.