EIP-2026-112605

The exploit describes an unauthenticated arbitrary file download vulnerability in TestLink versions 1.16 to 1.19. It leverages the 'attachmentdownload.php' endpoint with an iterable 'id' parameter and 'skipCheck=1' to bypass access controls and download files.