EUVD-2026-54432
GHSA-92px-7r7f-w562
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible Webbox requires only low-privilege auth; scope changes because other users' credentials and server private key are accessible beyond the vulnerable component.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user. A filter is in place that restricts access to the David con-fig folder and the user folder. However, this filter can be bypassed by specifying an alternate data stream, allowing the download of sensitive files such as other users' access files containing their passwords or the server's private key. This issue affects TeamDavid through Rollout 524.
AnalysisAI
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a valid low-privilege authenticated session on the TeamDavid Webbox interface - PR:L is confirmed by the CVSS 4.0 vector, meaning unauthenticated external attackers cannot directly exploit this; (2) access to the Webbox message composition functionality and specifically the 'scjob' form field that accepts the proprietary '@@attach' command; (3) the TeamDavid server must be running on Windows with NTFS, as the path filter bypass exploits NTFS Alternate Data Stream notation, which is a Windows filesystem feature unavailable on Linux or non-NTFS volumes; (4) the installed version must be at or before Rollout 524. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:L) accurately captures the severity: network-reachable, low attack complexity, requiring only low-privilege authentication, with high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade TeamDavid to a rollout version beyond Rollout 524 by consulting the vendor's release notes at https://david.tobit.software/releasenotes; no specific patched rollout number is explicitly confirmed in the available data, so administrators should contact Tobit Laboratories AG directly to verify that the installed rollout version addresses CVE-2026-54200. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all TeamDavid installations running Webbox Rollout 524 or earlier and restrict the Webbox messaging component to administrator-only access through network or firewall controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today