EUVD-2026-54445
GHSA-xjch-93pr-7c7c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no required privileges, but user must follow crafted link; scope changes because the injected redirect affects the victim's browser context beyond the originating server.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524.
AnalysisAI
HTTP header injection in Tobit Laboratories AG TeamDavid's Webbox component allows unauthenticated network attackers to manipulate HTTP response headers by embedding URL-encoded newline characters via the unsanitized 'cType' URL parameter, enabling open redirect attacks and potential HTTP response splitting. All Webbox deployments through Rollout 524 are affected, as catalogued by NCSC.ch and detailed in InfoGuard's research covering 22 CVEs in the TeamDavid platform. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects medium severity gated by required user interaction.
Technical ContextAI
The root cause is CWE-601 (URL Redirection to Untrusted Site), a subclass of improper neutralization of HTTP response headers. The Webbox component - a web-facing layer of Tobit Laboratories AG's TeamDavid, marketed as a secure Microsoft 365 alternative - accepts a 'cType' URL parameter and reflects it directly into the HTTP Content-Type response header without stripping control characters. URL-encoded newlines ('%0a') and carriage returns allow an attacker to terminate the current header line and inject additional arbitrary headers, including duplicate Location headers that browsers may follow as redirects. The affected CPE is cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*, meaning all TeamDavid versions through Rollout 524 are within scope. This class of vulnerability can also enable downstream attacks such as cache poisoning or cookie injection depending on intermediary proxy configurations.
RemediationAI
Upgrade TeamDavid to a rollout version newer than Rollout 524; the exact first-fixed rollout version is not independently confirmed from available data and must be verified against the vendor's release notes at https://david.tobit.software/releasenotes. Where immediate upgrading is not feasible, deploy a web application firewall rule to reject or sanitize requests containing URL-encoded control characters ('%0a', '%0d', '%0D', '%0A') within the 'cType' URL parameter - this directly blocks the injection vector with minimal functional side effects for legitimate use. Additionally, if a reverse proxy or CDN sits in front of Webbox, configuring it to strip or validate the Content-Type header value before forwarding responses to clients can act as a secondary barrier. User awareness campaigns reminding staff not to follow unexpected redirect URLs from trusted domains can reduce phishing impact in the interim period.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today