CVE-2026-63227 is an unrestricted file upload vulnerability affecting Koollab LMS. An authenticated module designer can upload a malicious SCORM package containing a PHP webshell to a publicly accessible directory on the server. Once uploaded, the attacker can execute arbitrary code remotely, effectively achieving full server compromise. The vulnerability requires authentication as a module designer, but no further privilege escalation is needed to exploit it. This issue has been reported via NVD and flagged in a CSA Singapore security advisory. The risk is rated High due to the potential for remote code execution on affected servers.