CVE-2026-54200

{
  "id": "CVE-2026-54200",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T10:16:56.640",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tobit Laboratories AG TeamDavid's Webbox  is vulnerable to a local file inclusion vulnerability in\n the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, \nwhich can then be downloaded by an authenticated user. A filter is in \nplace that restricts access to the David con-fig folder and the user \nfolder. However, this filter can be bypassed by specifying an alternate \ndata stream, allowing the download of sensitive files such as other \nusers' access files containing their passwords or the server's private \nkey. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."
    },
    {
      "lang": "es",
      "value": "La Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a una vulnerabilidad de inclusión local de ficheros en la funcionalidad de envío de correo electrónico, fax, SMS, etc. Al especificar un comando ’@@attach’ en el campo de formulario ’scjob’, se pueden adjuntar ficheros a un mensaje, que luego puede ser descargado por un usuario autenticado. Existe un filtro que restringe el acceso a la carpeta de configuración de David y a la carpeta de usuario. Sin embargo, este filtro puede ser eludido al especificar un flujo de datos alternativo, permitiendo la descarga de ficheros sensibles como los ficheros de acceso de otros usuarios que contienen sus contraseñas o la clave privada del servidor. Este problema afecta a TeamDavid hasta el Rollout 524."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Tobit Laboratories AG",
          "product": "TeamDavid",
          "defaultStatus": "unaffected",
          "modules": [
            "Webbox"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "Rollout 528",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T11:27:41.186723Z",
          "id": "CVE-2026-54200",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454",
      "source": "[email protected]"
    },
    {
      "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/",
      "source": "[email protected]"
    }
  ]
}