Loading vulnerability…
Unrestricted SCORM File Upload in Koollab LMS
CVE-2026-63227 is a critical unrestricted file upload vulnerability affecting Koollab LMS version 5.3.2. The flaw exists in the handling of SCORM package uploads and allows an authenticated user with the module designer role to upload a malicious SCORM archive containing server-executable PHP content. Because the uploaded content is placed in a publicly accessible directory and can then be executed by the web server, the issue enables arbitrary code execution on the underlying server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the Koollab LMS server in the context of the web application. This can lead to full compromise of application confidentiality, integrity, and availability, including deployment of persistent webshells, access to sensitive application data, modification of course content or user records, and potential follow-on activity on connected systems.
If you can’t patch tonight, do this now.
If patch status cannot be independently verified, restrict SCORM upload capability to the smallest possible set of trusted users, closely monitor SCORM package submissions, disable execution of server-side scripts in upload directories, and isolate uploaded learning content from the application runtime environment. Additional defensive measures include content inspection of uploaded archives and web server controls that prevent execution from user-controlled storage paths.
Patch, then assume compromise.
Vendor fixes were rolled out across cloud-hosted Koollab LMS instances on 2026-04-26. Remediation requires correcting SCORM upload handling so that uploaded packages cannot contain or expose server-executable content, enforcing strict validation of allowed archive contents, and ensuring uploaded files are stored outside web-accessible executable locations or served as inert content only.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.