Which versions of TeamDavid Webbox are affected by EUVD-2026-54434?

TeamDavid's Webbox archive tool contains a critical file creation vulnerability (CVE-2026-54202, CVSS 8.5) that allows authenticated users to create files in sensitive Windows system directories and…

How to fix or mitigate EUVD-2026-54434?

Within 24 hours: Identify all TeamDavid deployments at Rollout 524 or earlier and inventory current Webbox archive users; restrict archive creation permissions to a minimal set of trusted administrators and enable detailed logging of all archive operations. Within 7 days: If Webbox archive functionality is not critical to operations, disable it entirely; implement Windows filesystem access control lists (ACLs) on sensitive directories including C:\Windows to prevent unauthorized file creation; consider network segmentation for TeamDavid systems. Within 30 days: Monitor vendor advisories and test any released patches in non-production environments immediately; conduct an access review to remediate overly-permissive archive creation privileges; if no patch is provided by the vendor within 30 days, escalate to executive leadership for decision on alternative solutions or system decommissioning.

TeamDavid Webbox EUVD-2026-54434

Q: What is the CVSS score of EUVD-2026-54434?

EUVD-2026-54434 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-54202 HIGH

Absolute Path Traversal (CWE-36)

2026-08-07 NCSC.ch

GHSA-9r62-vc7q-pm8j

Path Traversal Microsoft Teamdavid Tobit Laboratories Ag

8.5

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

PR:L for required authentication; S:C as directories are created outside application scope; no confidentiality impact; high integrity, low availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 10:42 vuln.today

CVE Published

Aug 07, 2026 - 09:43 cve.org

HIGH 8.5

DescriptionCVE.org

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid through Rollout 524.

AnalysisAI

Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.

Technical ContextAI

TeamDavid, marketed by Swiss vendor Tobit Laboratories AG as a secure Microsoft 365 alternative, includes a Webbox component exposing archive creation functionality over the network. CWE-36 (Absolute Path Traversal) identifies the root cause: user-supplied archive path input is insufficiently validated server-side, permitting directory separator sequences and absolute path components to pass through unchecked. On Windows deployment targets this enables traversal to arbitrary filesystem locations including C:\Windows and other users' profile directories. The product is identified by CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*, covering all versions through Rollout 524. The InfoGuard research at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ reported 22 CVEs across the David platform, suggesting systemic input validation deficiencies rather than an isolated oversight.

RemediationAI

Upgrade TeamDavid to the first rollout version beyond Rollout 524 by consulting the vendor release notes at https://david.tobit.software/releasenotes for the exact patched rollout number; the precise fix version is not confirmed in the data available at time of analysis. If immediate upgrade is not feasible, apply Windows filesystem ACLs to restrict the TeamDavid service account from writing to sensitive directories such as C:\Windows and other users' profile directories - this limits blast radius but does not eliminate the vulnerability, and may cause unintended side effects if the service account legitimately requires broad write access. Additionally, restrict access to the archive creation feature to the minimum set of user roles that require it, reducing the number of accounts capable of triggering the flaw. Audit recently created directories in sensitive paths for signs of prior exploitation. The InfoGuard research at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ documents this and 21 related CVEs and should be reviewed for any additional platform-wide mitigations.