Gibbon vor 29.0.00 erlaubt CSRF.

The CSRF vulnerability in Gibbon CMS allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could enable an attacker to modify content, delete data, or even gain administrative access to the CMS, depending on the user's permissions and the actions targeted. This could result in defacement of the website, data loss, or complete compromise of the CMS installation. The impact is amplified if the CMS is used to manage sensitive data or handle user authentication.

Websites and organizations using Gibbon CMS versions 0.0 through 29.0.00 are at risk. This includes small businesses, non-profit organizations, and any entity relying on Gibbon for content management. Shared hosting environments are particularly vulnerable, as attackers may be able to exploit the vulnerability on multiple websites hosted on the same server.

• php / web: Examine access logs for unusual requests originating from different domains or IP addresses. Look for POST requests to sensitive endpoints (e.g., user management, content editing) that don't originate from the expected user's session.

grep -i 'gibbon' /var/log/apache2/access.log | grep -i 'POST' | grep -i 'user=';

• generic web: Use a web proxy or browser extension to monitor HTTP requests and identify any suspicious requests being sent to the Gibbon CMS.

1. 2025-05-27Disclosure

   disclosure

1. Reserviert2025-02-07
2. Veröffentlicht2025-05-27
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-26211 is to upgrade Gibbon CMS to version 29.0.00 or later, which includes the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and actions within the CMS. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also help to mitigate the risk. Regularly review and audit CMS configurations to ensure best practices are followed.