External risk intelligence

Koollab LMS Unrestricted SCORM Upload Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-63227

The vulnerability exists in a Learning Management System (LMS), which is typically deployed as a web application accessible over the internet to support remote users and students. Since the application is designed to be reachable for its intended function, the attack surface for this web-based file upload functionality is commonly internet-facing.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a Learning Management System (LMS) that could allow unauthorized code execution on the server. This issue stems from an unrestricted file upload capability within the system, enabling authenticated users to potentially compromise the server by uploading malicious packages. The primary concern is confirming if our organization utilizes this specific LMS and is therefore exposed to this risk.

Unrestricted file uploads allow server compromise.
Protects against code execution and data breaches.
Assess LMS usage and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker with module designer privileges can upload a malicious SCORM package to the Koollab LMS. Because this package can contain a PHP webshell and be placed in a publicly accessible location, an attacker can then trigger the webshell to execute arbitrary code on the server, potentially leading to a full compromise.

Authenticated module designer access required.
Uploading a SCORM package with a webshell.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An authenticated module designer could upload a malicious SCORM package containing a PHP webshell to a publicly accessible directory. When supported by the advisory, this could allow for the execution of arbitrary code on the server, potentially impacting system integrity and data confidentiality.

System files and data could be at risk.
Malicious code execution via file upload.
Compromise of server resources and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

In this scenario, the Koollab LMS application owner and the infrastructure team are most likely responsible for addressing this critical vulnerability. The immediate first step is to identify all instances of the Koollab LMS, determine their accessibility and business criticality, and then confirm the specific owner responsible for each instance to plan remediation.

Application and Infrastructure owners should lead.
Verify Koollab LMS instances and exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Koollab LMS?

Koollab LMS is a Learning Management System designed to host educational content and facilitate training. It allows instructors or module designers to import SCORM packages, which are standardized formats for e-learning materials, to track student progress and deliver interactive courses within an organizational or academic environment.

What does this vulnerability mean for security?

This vulnerability is classified as an unrestricted file upload issue. It occurs when a system fails to properly validate the contents or file type of an uploaded package. In the context of CVE-2026-63227, the application allows a file containing malicious server-side code to be saved to a location where it can be triggered, effectively turning a standard content-upload feature into a gateway for unauthorized command execution.

How does an attacker trigger CVE-2026-63227?

An attacker needs authorized access to the system as a module designer to initiate the exploit. They must specifically upload a crafted SCORM package that conceals a PHP webshell. The vulnerability does not trigger through standard student access or by simply viewing existing course content; it specifically requires the ability to use the file upload functionality reserved for those who create or manage training modules.

Why should I care about this vulnerability?

You should care if your organization runs Koollab LMS, as Halo Surface Signal identifies this as a critical concern for web-based platforms. Because these systems are intentionally designed to be internet-facing to support remote students and staff, the upload portal is often accessible from outside the internal network, increasing the risk that a compromised credential could be used to gain control over the underlying server.

Do I need to take action to secure my environment?

Yes. Start by creating an inventory of all Koollab LMS instances to confirm which systems are currently active and internet-accessible. Once you have identified your footprint, engage the application and infrastructure owners to track upcoming patches or security guidance from the vendor. Prioritize limiting access to the module designer role and monitoring for unusual file uploads until a fix is implemented.

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.