PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63228 Three Learning CVE debrief

CVE-2026-63228 is an unrestricted image upload vulnerability in Koollab LMS. An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server. This vulnerability has a low CVSS score of 2.6 and is considered low-severity. Defenders should assess exposure and verify the vulnerability's impact on their environment, focusing on Koollab LMS deployments. The CVE record and NVD entry provide limited information, so further verification is required to determine the actual impact and affected versions.

Vendor
Three Learning
Product
Koollab LMS
CVSS
LOW 2.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-10-23
Advisory published
2026-07-29
Advisory updated
2026-10-23

Who should care

Defenders responsible for Koollab LMS deployments should assess exposure and verify the vulnerability's impact on their environment. This includes reviewing the vulnerability's CVSS score of 2.6 and understanding the potential for further attacks on the server. Defenders should prioritize verifying the vulnerability's impact and assessing exposure in their environment, especially for Koollab LMS deployments.

Why it matters

CVE-2026-63228 is a low-severity vulnerability in Koollab LMS that allows authenticated attackers to upload malicious content, potentially enabling further attacks. Defenders should prioritize verifying the vulnerability's impact and assessing exposure in their environment.

  • Potential for further attacks on the server
  • Need for verification of vulnerability impact and exposure

Technical summary

The vulnerability allows an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server. This unrestricted image upload vulnerability in Koollab LMS has a CVSS score of 2.6, indicating low severity. The vulnerability's impact and affected versions need to be verified by defenders.

Defensive priority

Defenders should prioritize verifying the vulnerability's impact and assessing exposure in their environment.

Recommended defensive actions

  • Verify the vulnerability's impact on your environment
  • Assess exposure in your Koollab LMS deployment
  • Monitor for potential malicious activity

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63228 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63228

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63228 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63228

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

    5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.