EUVD-2026-54431
GHSA-pfmg-m2fv-v732
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, but victim interaction needed; integrity-only impact via injected headers, no direct confidentiality or availability loss.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to the redirect link, resulting in the ability to control the response headers. This issue affects TeamDavid through Rollout 524.
AnalysisAI
HTTP header injection in TeamDavid's Webbox component allows unauthenticated remote attackers to inject arbitrary HTTP response headers by embedding line feed (LF) characters in request body data sent to the link storing endpoint (//ServerClient_celink.htm). The injected data is appended unsanitized to the Location header of the 302 redirect response, enabling an attacker to control response headers against any user who interacts with a crafted link. This flaw is one of 22 CVEs disclosed by InfoGuard Labs in the David platform (marketed as a secure M365 alternative); no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-20 (Improper Input Validation), specifically the failure to strip or encode CRLF sequences (line feed characters, ASCII 0x0A) from user-supplied data before embedding it in HTTP response headers. The affected endpoint, //ServerClient_celink.htm, handles a link-storing feature in the Webbox interface of the TeamDavid platform (CPE: cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*). When a user-controlled value from the POST request body is appended to the redirect URL in a 302 response, any embedded LF character terminates the current header and begins a new one, giving an attacker full control over subsequent header lines. This class of attack - HTTP response splitting or CRLF injection - can be chained to perform cache poisoning, inject malicious cookies, facilitate cross-site scripting via injected Content-Type or Set-Cookie headers, or perform open redirect attacks. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reachability with no authentication required but with a dependency on user interaction.
RemediationAI
The primary remediation is to upgrade TeamDavid beyond Rollout 524; consult the vendor release notes at https://david.tobit.software/releasenotes to identify a patched rollout version. The InfoGuard Labs disclosure at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ provides additional context on all 22 disclosed CVEs and may include coordinated patch timelines. If upgrading immediately is not possible, a compensating control is to deploy a reverse proxy or WAF in front of the Webbox interface configured to strip or encode LF (0x0A) and CR (0x0D) characters from all inbound POST request bodies before they reach the application - this eliminates the injection vector with minimal functional impact. Additionally, restricting access to the //ServerClient_celink.htm endpoint to authenticated internal users via network controls (firewall rules or reverse proxy ACLs) would reduce the attack surface, though this may degrade legitimate link-sharing functionality. Note that a patched version number has not been independently confirmed from available data; verify with the vendor before concluding a specific rollout resolves this issue.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today