EUVD-2026-54436
GHSA-5g7h-mgc9-867w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint triggers credential leak to a subsequent system (scope change), with high confidentiality impact on captured NTLM credentials; no integrity or availability impact.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication.
This issue affects TeamDavid through Rollout 524.
AnalysisAI
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
TeamDavid is a groupware and messaging platform marketed by Tobit Laboratories AG as a Microsoft 365 alternative; its Webbox component exposes web-accessible search functionality. CWE-20 (Improper Input Validation) describes the root cause: the server applies no allowlist or scheme validation to the 'pathnameroot' parameter before resolving the supplied path. On Windows-based server infrastructure, resolving a UNC path (Universal Naming Convention, e.g., \\attacker.example.com\share) triggers the SMB client stack to automatically present the host's NTLM credentials - either as a Net-NTLMv1 or Net-NTLMv2 challenge-response - to the remote server. The CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:* covers all versions through Rollout 524. The provided CVSS 4.0 vector correctly models this as a subsequent-system confidentiality impact (SC:H) with no direct impact to the vulnerable system itself, reflecting the credential-relay threat model.
RemediationAI
The primary remediation is to update TeamDavid to the rollout version released after Rollout 524 that addresses this input validation flaw; consult the vendor release notes at https://david.tobit.software/releasenotes for the specific patched build - no exact fix version number was independently confirmed from available data. As an immediately actionable compensating control, block all outbound connections from the TeamDavid server to port 445 (TCP/UDP) and port 139 at the egress firewall; this prevents the NTLM credential from reaching attacker-controlled SMB infrastructure even if the endpoint is triggered. Trade-off: blocking outbound SMB may affect any legitimate UNC path resolution the platform uses for file access. Additionally, enforce Extended Protection for Authentication (EPA) on all domain controllers to prevent NTLM relay even if hashes are captured. Consider enabling SMB signing organization-wide to neutralize relay attack chains. Monitor for unexpected outbound connections from the server to port 445 as a detection signal.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today