Description

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T19:18:53.277Z",
  "pubdate": "2026-08-07T19:18:53.277Z",
  "executiveSummary": "TestLink version 1.9.20 and prior suffers from an insecure direct object reference vulnerability within its file retrieval mechanism. The flaw permits any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying sequential integer attachment IDs to the affected endpoint without undergoing any project or role-based authorization checks. The impact of this vulnerability is severe, as it enables malicious actors or unauthorized insiders to systematically bypass per-project access control models and harvest sensitive information across the entire application installation. Attackers can leverage this capability to access confidential test specifications, proprietary requirements documents, execution evidence, and other restricted uploaded files originating from private projects in which they maintain no formal membership. The risk implication is significant unauthorized data disclosure across multi-tenant or multi-project environments. Exploitation requires valid system authentication, such as a low-privilege guest account, and the ability to interact with the target application network interface. No complex preconditions or administrative privileges are necessary to execute the attack beyond the ability to issue HTTP requests to the vulnerable handler.",
  "technicalDetails": "The root cause of the vulnerability resides in the authorization logic failure within the attachment handling subsystem of TestLink 1.9.20 and prior. Specifically, the vulnerable component is the attachmentdownload.php handler, which processes requests for stored files based on raw integer identifiers. When an authenticated user submits an attachment ID to attachmentdownload.php, the application fails to validate whether the requesting user possesses valid project membership, role privileges, or explicit access rights to the specific project associated with the requested file resource. This absence of contextual access control checks allows the input parameters to be manipulated directly without restriction.\nThe exploitation method relies on insecure direct object reference techniques combined with automated enumeration. Because attachment IDs are typically implemented as sequential integers, an attacker can script requests to systematically iterate through integer ranges. The attack flow begins with the attacker authenticating to the TestLink installation using valid credentials, potentially leveraging a low-privilege guest account. Once authenticated, the attacker crafts HTTP requests targeting attachmentdownload.php, appending incremented integer values as the target identifier. The payload behavior consists of the server processing the unverified integer parameter, querying the underlying storage or database for the corresponding file reference, and streaming the file contents directly back to the client HTTP response stream.\nThe network exposure includes any deployment where the TestLink application is accessible to authenticated users over the network. The privilege requirements are minimal, necessitating only standard authentication such as a guest account. Post-exploitation impact encompasses total compromise of confidentiality for all uploaded assets within the application instance. Attackers can perform horizontal privilege escalation across project boundaries, extracting sensitive test specifications, proprietary requirements documents, and execution evidence from private projects without detection by standard access logging mechanisms tied to project-level permissions."
}