An authenticated user can send files through the feedback mail registration endpoint of Koollab LMS, where the system accepts any file as an image. If a malicious file is uploaded, subsequent processing may allow code execution or other server‑side attacks. The flaw is identified as CWE‑434, an unrestricted upload vulnerability. The primary impact is that an attacker who can authenticate to the LMS can potentially compromise the server, depending on how the application handles the uploaded file.

The vulnerability is present in Koollab LMS from Three Learning. No specific version numbers are provided, so any instance using the feedback mail registration endpoint that has not been patched may be affected.

The CVSS score is 2.6, indicating low severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires authentication, an attacker with valid user credentials could exploit the upload path to gain unintended server access. The likely attack vector is the LMS feedback mail registration endpoint supplied by an authenticated user.