Arbitrary File Deletion in Tobit Laboratories AG's TeamDavid Product
CVE-2026-12070

8.4HIGH

Key Information:

Vendor

Tobit Laboratories Ag

Status
Teamdavid
Vendor
CVE Published:
7 August 2026

What is CVE-2026-12070?

The Tobit Laboratories AG TeamDavid product is impacted by an arbitrary file deletion vulnerability within its email, fax, SMS functionalities. An attacker can exploit this issue by sending a specially crafted command in the form field 'scjob', allowing for the deletion of any file on the system. This vulnerability is present in TeamDavid from Rollout 524, posing a significant risk to data integrity.

Affected Version(s)

TeamDavid 0

References

https://david.tobit.software/releasenotes
release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Weiss of InfoGuard Labs
.