Unrestricted File Upload Vulnerability in Koollab LMS by Koollab
CVE-2026-63227

9.9CRITICAL

Key Information:

Vendor

An Unrestricted Scorm File Upload Vulnerability In Koollab Lms Allowed An Authenticated Module Designer To Upload A Scorm Package Containing A PHP Webshell To A Publicly Accessible Directory And Execute Arbitrary Code On The Server.

Status
Koollab Lms
Vendor
CVE Published:
29 July 2026

What is CVE-2026-63227?

An unrestricted file upload vulnerability in Koollab LMS can be exploited by authenticated module designers to upload SCORM packages containing malicious PHP webshells. This security flaw allows the execution of arbitrary code in a publicly accessible directory, jeopardizing the integrity and security of the server environment.

Affected Version(s)

Koollab LMS 5.3.2

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-20...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.