CVE-2026-54208

Technical Description

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an

unauthenticated attacker to create or write into existing files on the

server with attacker-controlled content. This is possible because user

input is written directly to files without proper validation or

restriction on file types. As a result, an attacker can create files

(e.g., .htm), containing malicious JavaScript code. When a user accesses

a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References