This vulnerability (CVE-2026-63227) in Koollab LMS 5.3.2 involves an unrestricted SCORM file upload flaw. An authenticated module designer can upload a SCORM package embedding a PHP webshell to a directory accessible publicly, leading to remote code execution on the server. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete confidentiality, integrity, and availability impact. There is no vendor-provided remediation or patch information available at this time.

Successful exploitation allows an authenticated module designer to execute arbitrary code on the server hosting Koollab LMS, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict module designer privileges and monitor for suspicious file uploads or webshell activity. Consider isolating the LMS server and limiting access to reduce risk.