CVE-2026-63228 — Unrestricted image upload vulnerability

CVE-2026-63228

Unrestricted image upload vulnerability PUBLISHED

Description (CNA)

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server.

Affected (CNA)

Vendor / product	Versions
Three Learning / Koollab LMS	affected 5.3.2

CWE

No CWE identifiers supplied.

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.