CVE-2021-40875

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

• CWE-425

• http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/SakuraSamuraii/derailedThird Party Advisory
• https://johnjhacking.com/blog/cve-2021-40875/Exploit, Third Party Advisory
• https://www.gurock.com/testrail/tour/enterprise-editionProduct, Vendor Advisory
• http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/SakuraSamuraii/derailedThird Party Advisory
• https://johnjhacking.com/blog/cve-2021-40875/Exploit, Third Party Advisory
• https://www.gurock.com/testrail/tour/enterprise-editionProduct, Vendor Advisory

Published

Sep 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40868In Cloudron 6.2, the returnTo parameter on the login page is…6.1
• CVE-2021-40870An issue was discovered in Aviatrix Controller 6.x before 6.…9.8
• CVE-2021-40871An issue was discovered in Softing Industrial Automation OPC…7.5
• CVE-2021-40872An issue was discovered in Softing Industrial Automation uaT…7.5
• CVE-2021-40873An issue was discovered in Softing Industrial Automation OPC…7.5
• CVE-2021-40874An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) …9.8
• CVE-2021-4088SQL injection vulnerability in Data Loss Protection (DLP) eP…7.2
• CVE-2021-40881An issue in the BAT file parameters of PublicCMS v4.0 allows…9.8
• CVE-2021-40882A Cross Site Scripting (XSS) vulnerability exists in Piwigo …6.1
• CVE-2021-40883A Remote Code Execution (RCE) vulnerability exists in emlog …9.8
• CVE-2021-40884Projectsend version r1295 is affected by sensitive informati…8.1
• CVE-2021-40886Projectsend version r1295 is affected by a directory travers…6.5