Report

Should I Use Gibbon?

gibbonedu.org·Analyzed 8 hours ago·9/21/2026·Based on 15 sources

Gibbon is a flexible, open source school management platform designed to make life better for teachers, students, parents and leaders.

Depends

Depends

Schools with their own IT staff get a genuinely free, full-featured school platform — if they commit to fast security patching.

Free open-source school platform; real value if you have IT staff, but a rough CVE record means patch fast.

Confidence: Medium

Free

Starting price

Open source, self-hosted

6+

Public CVEs found

2023–2026, incl. RCE and SQLi

10

G2 alternatives tracked

Competing school platforms

Value for money

5

Free, open source; no license fees

Feature depth

4

Full school platform including finance module

Support quality

2

Guess: community forum support, no vendor SLA

Security posture

1

Six-plus CVEs 2023–2026, including RCEs

Pros

Free and open source — no license fees^¹
Broad school modules, including finance^²
Active community of users, admins, developers^¹
Publishes security advisories on GitHub¹⁵
Tracked on G2, Capterra, and AWS Marketplace^⁵

Cons

Repeated serious CVEs: RCE, SQL injection, file inclusion^⁹
No security page found on the official site^³
Open source means hosting, updates, backups are on you^¹
No published vendor pricing or hosted tiers^⁸

Gotchas

highSelf-hosted: you provision hosting, run upgrades, and must patch fast when RCEs land^¹
highCVE-2026-8207 SQL injection affects versions before v30.0.0 — verify currency before deploying¹⁰
mediumFree core, but budget for hosting, migration, and admin time; no vendor tiers published^⁸
mediumSecurity info lives in a community forum category, not a proper security page^⁴

Best for

Schools with in-house IT
Budget-constrained schools wanting a full SIS
Open-source-friendly admin teams

Not for

Schools without a sysadmin — the CVE history demands fast patching
Tutoring or small teams needing just a gradebook
Buyers who need vendor support and SLAs
Anyone expecting polished hosted onboarding

Pricing

Community (self-hosted)

Free

Full open-source school platform
You host, maintain, and patch

Security

Rough record: multiple RCE, SQL injection, and file-inclusion CVEs between 2023 and 2026; patching discipline is mandatory.

CVE-2026-8208 — RCE via local file inclusionGibbon LMS local file inclusion leading to remote code execution.^⁹
CVE-2026-8207 — SQL injectionAffects Gibbon versions before v30.0.0.¹⁰
CVE-2024-24724 — remote code executionRCE vulnerability in Gibbonedu Gibbon.¹¹
CVE-2024-24725 — PHP deserializationDeserialization vulnerability exploited in Gibbon LMS.¹²
CVE-2023-34598 — local file inclusionGibbon v25.0.0 vulnerable to LFI.¹³

What users say

No substantive user reviews of the school platform surfaced; most 'Gibbon' search results concern unrelated products like slacklines and speakers.

Alternatives

Compare Gibbon with each alternative.

OpenSIS

Open-source student information system, similar self-hosted model.

Gibbon vs OpenSIS

PowerSchool

Commercial SIS with vendor hosting and support.

Gibbon vs PowerSchool

Fedena

School ERP aimed at smaller schools.

Gibbon vs Fedena

Google Workspace for Education

Simpler free option for small schools.

Gibbon vs Google Workspace for Education

Full analysis

Based on 15 public sources; user reviews are thin — most 'Gibbon' hits are unrelated products (slacklines, speakers, apes).

Sources

Gibbon — The Flexible School Platform (official)gibbonedu.org
official
Gibbon Finance feature (official)gibbonedu.org
official
Gibbon Security page (not found)gibbonedu.org
official
Gibbon Support Forum — Security categoryask.gibbonedu.org
official
Gibbon Reviews — G2g2.com
review
Top 10 Gibbon Alternatives & Competitors — G2g2.com
review
Gibbon Reviews — AWS Marketplaceaws.amazon.com
review
Gibbon Software Pricing — Capterracapterra.com
review
CVE-2026-8208 — Gibbon LMS RCE via LFIsentinelone.com
security
CVE-2026-8207 — Gibbon SQL Injectioncvefeed.io
security
CVE-2024-24724 — Gibbon RCEsentinelone.com
security
CVE-2024-24725 — PHP Deserialization in Gibbon LMSblog.secondx.io
security
CVE-2023-34598 — Gibbon v25.0.0 LFIgithub.com
security
CVE-2023-45878 — GibbonEdu v25.0.00 (NVD)nvd.nist.gov
security
Session Vulnerability in Gibbon Core (GHSA)github.com
security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

No comments yet.

Depends

Schools with their own IT staff get a genuinely free, full-featured school platform — if they commit to fast security patching.

Who it's for

Schools with in-house IT
Budget-constrained schools wanting a full SIS
Open-source-friendly admin teams

Who it's not for

Schools without a sysadmin — the CVE history demands fast patching
Tutoring or small teams needing just a gradebook
Buyers who need vendor support and SLAs
Anyone expecting polished hosted onboarding

Gotchas

Self-hosted: you provision hosting, run upgrades, and must patch fast when RCEs land¹
CVE-2026-8207 SQL injection affects versions before v30.0.0 — verify currency before deploying¹⁰
Free core, but budget for hosting, migration, and admin time; no vendor tiers published⁸
Security info lives in a community forum category, not a proper security page⁴

Pricing notes

Community (self-hosted): Free — Full open-source school platform; You host, maintain, and patch

Key capabilities

Free — Starting price (Open source, self-hosted)
6+ — Public CVEs found (2023–2026, incl. RCE and SQLi)
10 — G2 alternatives tracked (Competing school platforms)
Value for money: 5/5. Free, open source; no license fees
Feature depth: 4/5. Full school platform including finance module
Support quality: 2/5. Guess: community forum support, no vendor SLA
Security posture: 1/5. Six-plus CVEs 2023–2026, including RCEs

Security notes

Rough record: multiple RCE, SQL injection, and file-inclusion CVEs between 2023 and 2026; patching discipline is mandatory.

CVE-2026-8208 — RCE via local file inclusion. Gibbon LMS local file inclusion leading to remote code execution.⁹
CVE-2026-8207 — SQL injection. Affects Gibbon versions before v30.0.0.¹⁰
CVE-2024-24724 — remote code execution. RCE vulnerability in Gibbonedu Gibbon.¹¹
CVE-2024-24725 — PHP deserialization. Deserialization vulnerability exploited in Gibbon LMS.¹²
CVE-2023-34598 — local file inclusion. Gibbon v25.0.0 vulnerable to LFI.¹³

What to use instead

OpenSIS — Open-source student information system, similar self-hosted model. https://www.opensis.com
PowerSchool — Commercial SIS with vendor hosting and support. https://www.powerschool.com
Fedena — School ERP aimed at smaller schools. https://fedena.com
Google Workspace for Education — Simpler free option for small schools. https://edu.google.com

Sources

1.Gibbon — The Flexible School Platform (official) https://gibbonedu.org/
2.Gibbon Finance feature (official) https://gibbonedu.org/features/other/finance
3.Gibbon Security page (not found) https://gibbonedu.org/security
4.Gibbon Support Forum — Security category https://ask.gibbonedu.org/c/security/13
5.Gibbon Reviews — G2 https://www.g2.com/products/gibbon/reviews
6.Top 10 Gibbon Alternatives & Competitors — G2 https://www.g2.com/products/gibbon/competitors/alternatives
7.Gibbon Reviews — AWS Marketplace https://aws.amazon.com/marketplace/reviews/reviews-list/prodview-5urfgfdcqc3dc
8.Gibbon Software Pricing — Capterra https://www.capterra.com/p/164210/Gibbon/
9.CVE-2026-8208 — Gibbon LMS RCE via LFI https://www.sentinelone.com/vulnerability-database/cve-2026-8208/
10.CVE-2026-8207 — Gibbon SQL Injection https://cvefeed.io/vuln/detail/CVE-2026-8207
11.CVE-2024-24724 — Gibbon RCE https://www.sentinelone.com/vulnerability-database/cve-2024-24724/
12.CVE-2024-24725 — PHP Deserialization in Gibbon LMS https://blog.secondx.io/cve-2024-24725-exploiting-php-deserialization-vulnerability-in-gibbon-lms
13.CVE-2023-34598 — Gibbon v25.0.0 LFI https://github.com/maddsec/CVE-2023-34598
14.CVE-2023-45878 — GibbonEdu v25.0.00 (NVD) https://nvd.nist.gov/vuln/detail/CVE-2023-45878
15.Session Vulnerability in Gibbon Core (GHSA) https://github.com/GibbonEdu/core/security/advisories/GHSA-4mq5-8jvh-qq3p