CVE-2026-54202

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

• CWE-36

• https://chayns.net/77892-10814/tapp/763210?postId=11454
• https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Published

Aug 7, 2026

Last Modified

Sep 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54197Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1…6.5
• CVE-2026-54198Unauthenticated Cross Site Scripting (XSS) in Media LIbrary …7.1
• CVE-2026-54199Tobit Laboratories AG TeamDavid's Webbox is vulnerable to H…5.3
• CVE-2026-5420A security flaw has been discovered in Shinrays Games Goods …2.5
• CVE-2026-54200Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a…8.4
• CVE-2026-54201Tobit Laboratories AG TeamDavid's Webbox does not enforce a…6.9
• CVE-2026-54203Memory Leak to an Unauthorized Actor vulnerability in Tobit …9.2
• CVE-2026-54204Tobit Laboratories AG TeamDavid's Webbox 's search functiona…7.7
• CVE-2026-54205Tobit Laboratories AG TeamDavid's Webbox 's link storing fun…6.3
• CVE-2026-54206Tobit Laboratories AG TeamDavid's Webbox 's sending email, f…6.3
• CVE-2026-54207Tobit Laboratories AG TeamDavid's Webbox 's move archive fun…6.3
• CVE-2026-54208Tobit Laboratories AG TeamDavid's Webbox application is vuln…8.5