CVE-2026-63232
A critical vulnerability in Koollab LMS lets an authenticated user inject SQL and exploit unsafe deserialization to write a webshell and run arbitrary code on the server. The flaw is in the assessment reinforcement endpoint and can be triggered by a legitimate user account. It poses a severe risk to any site running the affected LMS.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Koollab LMS – any installation that has the assessment reinforcement endpoint enabled and allows authenticated users to submit data.
Real-world impact
An attacker who can log in to the LMS can inject malicious SQL, cause the system to unserialize crafted data, write a webshell to a publicly accessible directory, and then run arbitrary commands on the server, effectively taking full control of the web application and underlying host.
Why this severity
The CVSS score of 9.9 reflects the combination of network reachability, low attack complexity, and the need for only low privileges. Because the vulnerability requires an authenticated user, the attack complexity is low, but the impact is high: confidentiality, integrity, and availability are all compromised, and the exploit can be performed remotely over the network.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources