CVE Catalog
CVE-2026-63228
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk0.13%
3th percentile - higher than 3% of all known CVEs
Summary
An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint in Koollab LMS due to unrestricted image upload.
Risk Assessment
The attacker can place malicious files on the server, potentially leading to further attacks like code execution or compromise.
Recommendation
Update Koollab LMS and implement file type validation and antivirus scanning for uploaded images.
Original NVD description (English source)
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server.