CVE-2026-63227
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server. This means attackers can run any code on the server.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Koollab LMS (specific versions not listed). Users who run Koollab LMS and allow module designers to upload SCORM packages are affected.
Real-world impact
An attacker who can upload a malicious SCORM package can place a PHP webshell in a publicly accessible directory and run arbitrary code on the server, potentially taking full control of the system and compromising data, integrity, and availability.
Why this severity
The CVSS score of 9.9 reflects a network‑accessible attack with low complexity and low privilege requirements, no user interaction, and full compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources