CVE-2026-63228 describes an unrestricted image upload vulnerability in Three Learning's Koollab LMS product, specifically version 5.3.2. An authenticated attacker can exploit the feedback mail registration endpoint to upload malicious files disguised as images. The vulnerability has a CVSS 3.1 base score of 2.6, reflecting low severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. The impact is limited to integrity with no confidentiality or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

The vulnerability allows an authenticated user to upload malicious content disguised as images, potentially enabling further attacks on the server. However, the CVSS score and vector indicate that the impact is limited to integrity with no confidentiality or availability impact. The attack complexity is high and user interaction is required, reducing the likelihood of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Restricting authenticated user permissions and validating uploaded files on the server side may reduce risk until a patch is available.