An unrestricted SCORM file upload flaw in Koollab LMS allows an authenticated module designer to place a SCORM package that contains a PHP webshell into a publicly accessible directory, enabling arbitrary code execution on the server. This insecure file upload is classified as CWE‑434 and presents a critical threat to confidentiality, integrity and availability, as a malicious user could compromise the entire web application and underlying operating system.

The vulnerability impacts Koollab LMS. Because specific version information is not disclosed, any deployment that permits module designers to upload SCORM packages without proper validation is potentially exposed.

The CVSS score of 9.9 reflects a critical severity, while the EPSS score of <1% indicates low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Although the attacker must first be an authenticated module designer, the flaw eliminates file type restrictions and places uploaded content in a directory that is publicly reachable, allowing the attacker to deploy a PHP webshell and run arbitrary code. The exploitation path therefore requires authenticated access via the web interface followed by an upload of a crafted SCORM package containing malicious PHP code.