Arbitrary file upload in Three Learning Koollab Lms
CVE-2026-63228
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the ser…
Vulnerability class: Unrestricted File Upload
CVSS v3 metric
CVSS v3 base score 2.6 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Three Learning Koollab Lms — versions 5.3.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-63228?
- CVE-2026-63228 is a low-severity vulnerability in Three Learning Koollab Lms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 2.6/10. Published 2026-07-29.
- How severe is CVE-2026-63228?
- Low severity. CVSS v3 base score is 2.6 out of 10.