EUVD-2026-54441
GHSA-rghw-4g53-4wwv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network reach (PR:N/UI:N) but reliable impact is DoS while RCE needs favorable stack state or a canary leak, so AC:H; worst-case full compromise gives C/I/A:H.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.
Technical ContextAI
Tobit David is a German-market groupware/messaging and archiving platform (email, fax, voice, document archive) positioned as a Microsoft 365 alternative; the affected CPE is cpe:2.3:a:tobit_laboratories_ag:teamdavid:*. The Webbox component exposes web-facing file-upload endpoints whose native code copies the client-supplied filename into a fixed-size stack buffer without validating its length. This is a classic CWE-787 (Out-of-bounds Write) stack buffer overflow: the oversized filename overruns the buffer, corrupting adjacent stack memory (saved registers, return address, canary). Because the parsing occurs before authentication, the attacker-controlled data reaches the vulnerable copy without credentials.
RemediationAI
Upgrade to a David Rollout newer than 524, which is the boundary the advisory identifies as affected; consult the official release notes at https://david.tobit.software/releasenotes to confirm the exact fixed Rollout number, since a specific patched version string was not included in the provided data (fix version not independently verified). Until patched, reduce exposure by removing the Webbox/file-upload interface from direct internet reachability - place it behind a VPN or restrict source IPs at the firewall - and, if your fronting reverse proxy or WAF supports it, reject upload requests with abnormally long filenames or filename fields to cut off the overflow input; note that filename-length filtering can break legitimate uploads of long-named documents and IP restriction reduces remote-worker usability. Because unauthenticated crashes are the reliable outcome, prioritize restricting who can reach the endpoint over relying on input filtering alone. Additional context is available in the InfoGuard Labs write-up (https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/).
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today