Which versions of TeamDavid Webbox are affected by CVE-2026-12070?

Tobit TeamDavid's Webbox component contains a high-severity file deletion vulnerability (CVE-2026-12070, CVSS 8.4) affecting all deployments through Rollout 524, enabling authenticated users to…

How to fix or mitigate CVE-2026-12070?

Immediate action (24 hours): Inventory all Tobit TeamDavid Webbox deployments and current rollout versions; identify all users with access to the messaging interface and scjob form field. Within 7 days: Restrict Webbox messaging component access to essential personnel only; implement input validation filtering to block @@COMMENTFILE directives in form submissions; enable detailed audit logging for all file deletion operations and establish real-time alerting. Within 30 days: Contact Tobit for patch timeline and security roadmap; evaluate alternative solutions or formalize risk acceptance; conduct authorized penetration testing of the scjob form field injection vector; deploy network segmentation isolating TeamDavid systems to limit exploitation blast radius.

TeamDavid Webbox CVE-2026-12070

Q: What is the CVSS score of CVE-2026-12070?

CVE-2026-12070 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54424 HIGH

External Control of File Name or Path (CWE-73)

2026-08-07 NCSC.ch

GHSA-8rv5-p2xx-4q2w

Information Disclosure Teamdavid Tobit Laboratories Ag

8.4

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-accessible via web form, no complexity once authenticated (PR:L, AC:L); arbitrary deletion of any server file constitutes high integrity and high availability impact with zero confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:H

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 10:06 vuln.today

CVE Published

Aug 07, 2026 - 09:40 cve.org

HIGH 8.4

DescriptionCVE.org

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 524.

AnalysisAI

Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.

Technical ContextAI

TeamDavid is a collaboration platform by Tobit Laboratories AG (Germany) marketed as a Microsoft 365 alternative, providing email, fax, SMS, and unified communications via its Webbox web interface. CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:* covers all versions. CWE-73 (External Control of File Name or Path) is the root cause - the application exposes an internal server-side command syntax (the @@ macro/directive language used natively by the David platform) directly through the user-facing scjob form parameter without sanitization or allowlisting. When the server processes the messaging job, it interprets @@COMMENTFILE as a legitimate directive and deletes the referenced path using the application process's file system permissions, which likely run with elevated OS privileges given the fax/telephony integration requirements of this class of software.

RemediationAI

Verify whether a rollout beyond 524 addresses this vulnerability by consulting the Tobit TeamDavid release notes at https://david.tobit.software/releasenotes and the infoguard.ch disclosure at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ for coordinated disclosure timeline. Upstream fix availability has not been independently confirmed - contact Tobit Laboratories AG directly to obtain a patched build. As immediate compensating controls: restrict Webbox messaging functionality to the minimum required user population via role-based access controls to reduce the number of accounts that can reach the vulnerable scjob parameter; deploy a web application firewall rule to block or alert on HTTP requests containing the @@COMMENTFILE string in any form parameter (trade-off: may affect legitimate use of @@ directives in message bodies if any are permitted); and enforce OS-level least-privilege for the David service account to limit which files the application process can delete, reducing blast radius even if exploitation occurs. Note that file system ACL hardening alone does not close the vulnerability - it only constrains which files can be deleted.