CVE-2026-63228CWE-434unrestricted-file-upload

CVE-2026-63228

Low · published July 29, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

An unrestricted image upload vulnerability in

Koollab LMS allowed

an authenticated attacker to upload malicious content disguised as an image

file via the feedback mail registration endpoint, potentially enabling further

attacks on the server.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00205 · 10.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-29T11:16Z
References (1)
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/ · 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
EPSS history
Timeline
  • 29 JUL 06:08Z
    Unrestricted image upload vulnerability
    cvelistv5