QaTraq version 6.9.2 contains a vulnerability that allows authenticated users to upload arbitrary files through the 'Add Attachment' feature in the 'Test Script' module. The application does not restrict file types, permitting the upload of executable PHP files. These files can then be accessed and executed on the server via the 'View Attachment' option, leading to potential remote code execution.