CVE-2026-63228

Published: Jul 29, 2026Modified: Jul 30, 2026Deferred

2.6

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Exploitability: 1.2 / Impact: 1.4

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4 (Secondary)

Description

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server.

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (1)

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Timeline

No history available yet.