CVE-2026-54214

Technical Description

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the

“cType” URL parameter, which allows arbitrary modification of the

Content-Type header in HTTP responses. Because the parameter does not

properly restrict control characters such as URL-encoded newlines

(“%0a”) or colons, attackers can inject additional headers including

extra Location headers into the server’s response. This results e.g. in

an open redirect vulnerability. This issue affects TeamDavid through Rollout 524.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References