CVE-2026-54200 Overview
CVE-2026-54200 is a local file inclusion (LFI) vulnerability [CWE-73] in Tobit Laboratories AG TeamDavid's Webbox component. The flaw resides in the send email, fax, and SMS functionality. An authenticated attacker can supply an @@attach command in the scjob form field to attach arbitrary files to a message and subsequently download them. A path filter blocks access to the David configuration and user folders, but the filter can be bypassed using an NTFS Alternate Data Stream (ADS). Successful exploitation exposes other users' access files containing passwords and the server's private key. The issue affects TeamDavid through Rollout 524.
Critical Impact
Authenticated attackers can retrieve stored user credentials and the server's private key, enabling account takeover and downstream impersonation of the TeamDavid server.
Affected Products
- Tobit Laboratories AG TeamDavid Webbox
- TeamDavid releases through Rollout 524
- David messaging server components exposing Webbox functionality
Discovery Timeline
- 2026-08-07 - CVE-2026-54200 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-54200
Vulnerability Analysis
The vulnerability sits in the Webbox message composition workflow. When a user submits a job through the scjob form field, the handler accepts an @@attach directive that specifies a file path to attach to the outgoing email, fax, or SMS. The server then makes the attached file downloadable to the authenticated user. This design assumes attachments originate from legitimate user-writable locations, but the path handler does not sufficiently constrain filesystem access.
The developers implemented an allowlist-style filter that rejects paths pointing to the David config folder and to other users' folders. However, the filter matches on the visible file path only and does not account for NTFS Alternate Data Streams. By appending a stream specifier such as ::$DATA or a named stream to a protected path, an attacker constructs a reference that resolves to the same protected file on disk while evading the string-based filter. The server opens the file through the ADS reference, attaches it, and delivers the contents to the requester.
Root Cause
The root cause is incomplete input validation on the @@attach parameter combined with reliance on syntactic path filtering. The filter does not canonicalize paths before comparison and does not strip or account for NTFS stream suffixes. This is a classic external control of file name or path weakness [CWE-73], where the security decision is made on a normalized-looking string rather than on the resolved filesystem object.
Attack Vector
Exploitation requires network access to the Webbox interface and valid authenticated credentials. The attacker submits a crafted message job containing an @@attach command with a path targeting sensitive server files, appended with an alternate data stream reference to bypass the folder filter. Target files include per-user access files that store credentials and the private key protecting the David server's TLS or signing operations. The attacker then downloads the resulting attachment to retrieve the file contents. Refer to the Infoguard CVE Analysis for a detailed walkthrough of the @@attach and ADS bypass technique.
Detection Methods for CVE-2026-54200
Indicators of Compromise
- Web server or application logs containing POST requests to Webbox job endpoints where the scjob field includes the string @@attach.
- Attachment path values referencing NTFS stream syntax such as ::$DATA or :streamname in message job submissions.
- Outbound message records where the attachment source resolves to files under the David config directory, user profile directories, or private key locations.
- Anomalous downloads of message attachments by an account shortly after the account submitted a self-addressed job.
Detection Strategies
- Inspect Webbox request bodies for @@attach directives whose path components contain : outside of a drive letter position.
- Correlate authenticated Webbox job submissions with subsequent attachment download events from the same session and flag self-addressed messages that reference server system paths.
- Baseline normal attachment source directories per user and alert on deviations that reach configuration or key material paths.
Monitoring Recommendations
- Enable verbose request logging on the David Webbox interface and forward logs to a centralized analytics platform.
- Monitor file access events on the David config folder and on files holding private keys, alerting on reads by the David service outside of startup.
- Track authentication events for Webbox accounts and investigate low-privilege accounts that begin generating high volumes of message jobs.
How to Mitigate CVE-2026-54200
Immediate Actions Required
- Upgrade TeamDavid to a release later than Rollout 524 once Tobit publishes a fixed build; consult the David Tobit Release Notes for availability.
- Restrict network access to the Webbox interface to trusted networks or VPN clients until a patched release is deployed.
- Rotate all David user access-file passwords and reissue the David server's private key, assuming exposure until logs are reviewed.
- Audit historical Webbox job submissions for @@attach values containing stream separators and investigate any hits.
Patch Information
Tobit Laboratories tracks fixes in the David release notes. Administrators should review the David Tobit Release Notes for the rollout that supersedes 524 and addresses the @@attach path filter bypass. Apply the vendor update on the David server hosting Webbox and verify the rollout version after installation.
Workarounds
- Place the Webbox endpoint behind a reverse proxy that inspects and rejects requests where the scjob field contains @@attach combined with : in the path.
- Tighten filesystem ACLs on the David config directory and private key files so the David service account has the minimum access required.
- Disable or limit Webbox message submission for low-trust accounts until the vendor patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
