PT-2026-3036 · Testlink · Testlink

Gonzalo Villegas · CVE-2021-47760 · Published 2026-01-15 · Updated 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TestLink versions 1.16 through 1.19

Description The software contains an unauthenticated file download issue. An attacker can download arbitrary files by manipulating the id parameter in the ''attachmentdownload.php'' endpoint, utilizing 'skipCheck=1' to circumvent access controls.

Recommendations Update TestLink to a version later than 1.19.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-47760

Affected Products

Testlink

References · 7

• 🔥 https://exploit-db.com/exploits/50578 · Exploit
• 🔥 https://web.archive.org/web/20211208031345/https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47760 · Security Note
• https://twitter.com/CveFindCom/status/2011840841375977878 · Twitter Post
• https://testlink.org · Note
• https://twitter.com/CVEnew/status/2011926108175024616 · Twitter Post
• https://twitter.com/cracbot/status/2013567245226840348 · Twitter Post