Arbitrary File Write Vulnerability in Tobit Laboratories TeamDavid's Webbox Application
CVE-2026-54208

8.5HIGH

Key Information:

Vendor

Tobit Laboratories Ag

Status
Teamdavid
Vendor
CVE Published:
7 August 2026

What is CVE-2026-54208?

The Webbox application by Tobit Laboratories AG is susceptible to an arbitrary file write vulnerability that enables an unauthenticated attacker to create or modify files on the server using unchecked user input. This flaw allows malicious content, such as JavaScript code, to be written to files, which can then trigger stored cross-site scripting (XSS) when accessed by users. Proper validation and restrictions on the types of files being written are not implemented, leading to potential exploitation of the system.

Affected Version(s)

TeamDavid 0

References

https://david.tobit.software/releasenotes
release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Weiss of InfoGuard Labs
Lucas Dodgson of InfoGuard Labs
.