Vulnerability · Published Jul 29, 2026 · Assigned by CSA
CVE-2026-63228Unrestricted image upload vulnerability
Low 2.6
In plain English
A low-severity unrestricted file upload in Koollab LMS from Three Learning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)2.6Low
Exploit odds (30 days)0.2%top 89.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Three Learning | Koollab LMS | 5.3.2 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N