Loading vulnerability…
Unrestricted Image Upload in Koollab LMS Feedback Mail Registration Endpoint
CVE-2026-63228 is an unrestricted file upload vulnerability affecting Koollab LMS 5.3.2. The flaw exists in the feedback mail registration endpoint, where the application fails to adequately validate uploaded image content. An authenticated attacker can submit malicious content disguised as an image file, allowing untrusted files to be stored by the application. Although described as an image upload issue, the core weakness is insufficient enforcement of file type restrictions on user-supplied upload content, creating an avenue for server-side abuse and follow-on attacks depending on how the uploaded content is stored, processed, or later accessed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to place malicious content on the server through the feedback mail registration functionality. This can enable further attacks against the application or hosting environment, such as abuse of stored content, delivery of malicious payloads, or other server-side compromise paths depending on deployment and file handling behavior. The available information does not confirm direct code execution from this vulnerability alone.
If you can’t patch tonight, do this now.
Where immediate remediation is not otherwise available, restrict access to the vulnerable upload functionality to only necessary users, apply strict content-type and file-signature validation for image uploads, store uploaded files outside executable or web-accessible locations, and ensure uploaded content is served only as inert data. Additional monitoring of upload activity and review of stored user-supplied files can help detect abuse.
Patch, then assume compromise.
The vendor stated that fixes were rolled out to all cloud-hosted Koollab LMS instances on 2026-04-26. Remediation requires enforcing strict server-side validation of uploaded files at the feedback mail registration endpoint, including verification of allowed file types, rejection of non-image content, and ensuring uploaded content cannot be abused as active or executable server-side material.
No public exploits tracked yet. Mallory keeps watching.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.