CVE-2026-70561
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in TestLink 1.9.20 and earlier is an insecure direct object reference (IDOR) that allows any authenticated user, including guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without project or role authorization checks. Attackers can enumerate sequential IDs to retrieve files from private projects.
Risk Assessment
The risk is exposure of sensitive data such as test specifications, requirements documents, or execution evidence, bypassing per-project access control.
Recommendation
Upgrade TestLink to the latest version and implement project-level access controls for attachment downloads.
Other vulnerabilities in TestLink
See all- CVE-2014-8081High
The execSetResults.php file in TestLink before version 1.9.13 has a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
- CVE-2014-5308High
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
- CVE-2015-7390Critical
CVE-2015-7390 in TestLink before version 1.9.14 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the apikey parameter in lnl.php.
Original NVD description (English source)
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS