EUVD-2026-54439
GHSA-9qx3-7v72-8555
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network unauthenticated file write (PR:N, AV:N, AC:L) with stored XSS requiring victim visit (UI:R); scope changes to browser context (S:C); high integrity from content injection, low confidentiality from cookie access.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.
Technical ContextAI
TeamDavid is a groupware and collaboration platform by Tobit Laboratories AG, marketed as a Microsoft 365 alternative (documented in the InfoGuard research covering 22 CVEs in this product). The affected component, Webbox, is the platform's web-based interface. The root cause is CWE-20 (Improper Input Validation): the application accepts attacker-supplied content and writes it to the filesystem without enforcing restrictions on file type, extension, or content. This allows creation of .htm files whose JavaScript payloads are later served by the same web server, completing a two-phase attack. The affected CPE (cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*) covers all TeamDavid versions through Rollout 524 with no version floor specified, suggesting the flaw is not a recent regression but a systemic design gap.
RemediationAI
Administrators should upgrade TeamDavid beyond Rollout 524; consult the vendor's release notes at https://david.tobit.software/releasenotes for the specific patched rollout number, as no exact fix version was confirmed in available data. If an immediate upgrade is not feasible, restrict network access to the Webbox interface to trusted internal network segments only - because the file write is unauthenticated (PR:N, AV:N), perimeter exposure significantly amplifies risk. As a secondary control, implement web application firewall rules to block unexpected file-write request patterns targeting Webbox endpoints, though rule-based filters are not a substitute for patching. Deploying Content Security Policy headers (e.g., default-src 'self'; script-src 'self') on the Webbox origin can limit the blast radius of any stored XSS payloads already planted, reducing their ability to load external scripts or exfiltrate data to attacker-controlled domains. Monitor server-side directories served by Webbox for unexpected .htm or .html files as an indicator of prior exploitation.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today