CVE-2026-63227: Koollab LMS SCORM File Upload Allows Webshell Deployment and RCE

Overview

CVE-2026-63227 is a critical-severity vulnerability (CVSS 9.9) in Koollab LMS that stems from unrestricted SCORM file upload functionality. An authenticated user with module designer privileges can upload a SCORM package that contains a PHP webshell. Once uploaded to a publicly accessible directory, the webshell can be invoked via HTTP to execute arbitrary commands on the server.

What Is SCORM?

SCORM (Sharable Content Object Reference Model) is a widely used e-learning standard that packages course content — HTML, JavaScript, media, and metadata — into a ZIP archive. Many LMS platforms extract and serve these packages directly from the web root to allow the embedded HTML/JS to run in a browser. When an LMS fails to validate SCORM package contents for dangerous file types, an attacker can embed a PHP webshell inside the ZIP and have it extracted to a web-accessible location.

Technical Details

Koollab LMS accepts SCORM package uploads from users with the module designer role, but does not enforce restrictions on the file types contained within the uploaded archive. The attack proceeds as follows:

1. Craft malicious SCORM package: Create a standard SCORM-compliant ZIP archive that includes a PHP webshell (e.g., shell.php) alongside legitimate SCORM manifest files.
2. Upload via LMS interface: Use the module designer's legitimate upload workflow to submit the package — no exploit of the upload mechanism itself is required.
3. LMS extracts package: The LMS decompresses the SCORM ZIP into a publicly accessible web directory (e.g., under /content/ or /uploads/scorm/).
4. Webshell accessible: The extracted shell.php is now reachable via HTTP.
5. Remote code execution: Send HTTP requests to the webshell URL to execute arbitrary OS commands as the web server user.

The CVSS score of 9.9 reflects that while authentication is required (module designer role), exploitation requires no additional technical skill beyond crafting a ZIP file, and the impact is complete server compromise.

Impact

• Arbitrary OS command execution on the web server.
• Full access to the LMS database, including student PII, credentials, and course records.
• Persistence via the planted webshell, which survives LMS updates if not manually removed.
• Lateral movement to other services accessible from the compromised server.

Affected Software

Remediation

1. Apply vendor patches immediately. Monitor the Koollab LMS vendor portal and NVD for patched releases.
2. Restrict SCORM upload permissions to the minimum required set of trusted users while patches are pending.
3. Implement server-side file type validation — scan extracted SCORM archives and block or quarantine any PHP/executable files before they land in web-accessible directories.
4. Move SCORM extraction directories outside the web root where possible, serving content via a proxy that strips executable file types.
5. Audit uploaded SCORM packages for existing webshells: find /path/to/scorm -name '*.php' -not -name 'api.php'.
6. Review module designer role assignments and remove unnecessary permissions.

Related Vulnerability

This CVE affects the same product as CVE-2026-63232, which describes a separate SQL injection and unsafe deserialisation flaw also in Koollab LMS. Organisations running Koollab should treat both as requiring immediate remediation.

References

• NVD — CVE-2026-63227
• CVSS Score: 9.9 Critical