CVE-2021-40875: Gurock TestRail improper access control exposes file list and secrets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.5 with no authentication or interaction required, public exploit references, and a very high EPSS percentile make this a high-priority exposure despite no KEV listing.

What it is

TestRail versions before 7.2.0.3014 allow unauthenticated access to the /files.md5 file, which lists application files and their paths. Those paths can be probed and in some cases reveal hardcoded credentials, API keys, or other sensitive data. The flaw is a straightforward access control failure on a client-side file, so it matters to any internet-exposed TestRail instance.

Impact

An attacker gains a full inventory of application files and paths, and can use that map to reach files that may contain hardcoded credentials or API keys. This is information disclosure only; there is no code execution or data modification in the described flaw.

Attack surface

Reached over the network by requesting /files.md5 directly from the TestRail application. The CVSS vector shows no privileges and no user interaction required, so the endpoint is reachable by an unauthenticated remote client.

Exploitation

Not listed in CISA KEV, but EPSS is 0.48417 (98.8th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware group use is documented.

What to do

• Upgrade TestRail to 7.2.0.3014 or later, which is the fixed version named in the advisory.
• If immediate upgrade is not possible, block or restrict access to /files.md5 at the web server or reverse proxy.
• Do not expose TestRail directly to the internet; place it behind VPN or an authenticated gateway.
• Rotate any credentials, API keys, or tokens that may have been stored in files reachable through the disclosed paths.
• Review file permissions and remove hardcoded secrets from application files.
• Search logs for requests to /files.md5 and treat any hits as potential reconnaissance.

Detection

• Alert on HTTP requests to /files.md5 in web server or WAF logs, especially from unauthenticated clients.
• Baseline normal TestRail file access and flag enumeration of many file paths in a short window.
• Monitor for outbound or follow-up requests to paths disclosed in files.md5 that are not part of normal application traffic.
• Audit exposed TestRail instances for the presence of /files.md5 and confirm the deployed version.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.