CVE-2026-12070: TeamDavid Webbox File Deletion Vulnerability

CVE-2026-12070 Overview

CVE-2026-12070 is an arbitrary file deletion vulnerability in Tobit Laboratories AG TeamDavid's Webbox. The flaw resides in the send email, fax, and SMS functionality. An authenticated attacker can supply an @@COMMENTFILE command in the scjob form field to delete any file on the underlying system. The issue affects TeamDavid through Rollout 524 and is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
Authenticated attackers can delete arbitrary files on the host, disrupting mail, fax, and SMS services and potentially rendering the TeamDavid installation inoperable.

Affected Products

Tobit Laboratories AG TeamDavid (Webbox component)
TeamDavid releases up to and including Rollout 524
Deployments exposing the send email, fax, or SMS functionality to authenticated users

Discovery Timeline

2026-08-07 - CVE-2026-12070 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-12070

Vulnerability Analysis

The vulnerability exists in the Webbox component of TeamDavid, which processes messaging jobs for email, fax, and SMS delivery. The scjob form field accepts control directives that the server interprets before dispatching a message. One such directive, @@COMMENTFILE, points the server at a filesystem path used to attach comment content to the outgoing job.

The server does not validate or constrain the path supplied to @@COMMENTFILE. An attacker can reference any file readable by the TeamDavid service account. When the job completes or is cleaned up, the referenced file is removed from disk. This turns a routine message submission into an arbitrary file deletion primitive.

The attack requires network access and low-privilege authentication. No user interaction is needed. Impact centers on integrity and availability: deleting configuration files, service binaries, or message stores can crash the product, destroy business records, or force reinstallation.

Root Cause

The root cause is external control of a file name and path passed through user-controlled input [CWE-73]. The @@COMMENTFILE handler trusts the value supplied in the scjob field and performs a deletion operation without allowlist validation, path canonicalization, or containment to a job-specific working directory.

Attack Vector

An authenticated user submits a crafted HTTP request to the Webbox endpoint that processes send jobs. The request populates the scjob field with an @@COMMENTFILE directive referencing a sensitive path on the host. The server processes the job and deletes the target file when the temporary comment resource is cleaned up. See the Infoguard CVE Analysis Post for additional technical context.

Detection Methods for CVE-2026-12070

Indicators of Compromise

HTTP POST requests to Webbox send endpoints containing the string @@COMMENTFILE inside the scjob parameter.
Unexpected deletion of TeamDavid configuration files, mailbox archives, or service binaries under the David installation directory.
Webbox job logs referencing comment file paths outside the standard temporary or spool directories.
Service failures or restart loops following a message submission from a low-privilege account.

Detection Strategies

Inspect web server and application logs for scjob submissions containing @@ directives that reference absolute paths or path traversal sequences.
Enable filesystem auditing on the David installation directory and correlate DELETE events with process activity from the TeamDavid service.
Alert on file deletion events targeting .exe, .dll, .ini, or archive files inside the product directory outside of maintenance windows.

Monitoring Recommendations

Baseline the volume and content of scjob submissions and alert on anomalous directive usage from individual accounts.
Forward Webbox access logs and Windows Security event logs to a centralized analytics platform for correlation.
Monitor authentication logs for low-privilege accounts issuing message send jobs at unusual rates or times.

How to Mitigate CVE-2026-12070

Immediate Actions Required

Upgrade TeamDavid to the release published after Rollout 524 as documented in the David Tobit Release Notes.
Restrict Webbox access to trusted networks and authenticated users who require send email, fax, or SMS functionality.
Audit recent Webbox submissions for the @@COMMENTFILE directive and investigate any matches.
Back up TeamDavid configuration, message stores, and databases before applying updates.

Patch Information

Tobit has addressed the issue in a TeamDavid release subsequent to Rollout 524. Administrators should consult the David Tobit Release Notes to identify the fixed rollout and apply it across all Webbox-enabled hosts. Detailed vulnerability context is published by the researchers at the Infoguard CVE Analysis Post.

Workarounds

Place the Webbox interface behind a reverse proxy that filters request bodies containing @@COMMENTFILE in the scjob field.
Reduce the TeamDavid service account's filesystem permissions so that it cannot delete files outside its working directories.
Disable the send email, fax, and SMS Webbox functionality for user roles that do not require it until the patch is applied.

bash

# Example reverse-proxy filter (NGINX) blocking the vulnerable directive
location /webbox/ {
    if ($request_body ~* "@@COMMENTFILE") {
        return 403;
    }
    proxy_pass http://teamdavid_backend;
}