CVE-2020-8639

PoC ×2—

CVSS 3.1

8.8 high

EPSS

16%p97

Published

Apr 3, 2020 (Apr 3, 2020)

Modified

Jun 17, 2026

Description

An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to a publicly accessible directory of the application.

Vendors: testlink
Products: testlink
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (15.9%)

In the news0 stories

No ingested article mentions this CVE yet.