CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS

No CVSS.

References

Link	Resource
https://chayns.net/77892-10814/tapp/763210?postId=11454
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-07 10:16

Updated : 2026-09-07 13:20

NVD link : CVE-2026-54208

Mitre link : CVE-2026-54208

CVE.ORG link : CVE-2026-54208

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-284

Improper Access Control

{"id": "CVE-2026-54208", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54208", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:41:23.183708Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:57.740", "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an \nunauthenticated attacker to create or write into existing files on the \nserver with attacker-controlled content. This is possible because user \ninput is written directly to files without proper validation or \nrestriction on file types. As a result, an attacker can create files \n(e.g., .htm), containing malicious JavaScript code. When a user accesses\n a file created in this way, stored cross-site scripting is triggered.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}], "lastModified": "2026-09-07T13:20:28.347", "sourceIdentifier": "vulnerability@ncsc.ch"}