CVE-2026-54202 PUBLISHED

TeamDavid: Path Traversal in the archive creation functionality

Assigner: NCSC.ch
Reserved: 12.06.2026 Published: 07.08.2026 Updated: 07.08.2026

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid through Rollout 524.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
CVSS Score: 8.5

Product Status

Vendor Tobit Laboratories AG
Product TeamDavid
Versions Default: unaffected
  • affected from 0 to Rollout 524 (incl.)

Credits

  • Dario Weiss of InfoGuard Labs finder

References

Problem Types

  • CWE-36 Absolute path traversal CWE