CVE-2026-54202 Overview
CVE-2026-54202 is a path traversal vulnerability in Tobit Laboratories AG TeamDavid's Webbox component. The flaw exists in the archive creation functionality, where the archive path is user-controlled and insufficiently validated. Attackers can manipulate the input to traverse directories and create folders in arbitrary locations, including sensitive system directories such as C:\Windows or directories belonging to other users. The issue affects TeamDavid through Rollout 524 and is categorized under [CWE-36] Absolute Path Traversal.
Critical Impact
Authenticated attackers can create directories in arbitrary filesystem locations, enabling tampering with system paths, other users' data, and Windows OS directories.
Affected Products
- Tobit Laboratories AG TeamDavid Webbox
- TeamDavid through Rollout 524
- Tobit David groupware platform
Discovery Timeline
- 2026-08-07 - CVE-2026-54202 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-54202
Vulnerability Analysis
The vulnerability resides in the Webbox archive creation feature of Tobit TeamDavid. When a user initiates archive creation, the application accepts a target path parameter that is passed to directory creation logic without adequate sanitization. Because the input handling does not restrict traversal sequences or reject absolute paths, an authenticated attacker can supply crafted values that resolve outside the intended archive storage location.
Successful exploitation lets an attacker create arbitrary directories anywhere the service account has write access. Since TeamDavid typically runs with elevated privileges on Windows hosts, this includes protected locations such as C:\Windows and per-user profile directories. Creating attacker-controlled folders in sensitive locations can support follow-on attacks, including DLL search-order hijacking, denial of service against Windows services, and tampering with other users' data stores.
Root Cause
The root cause is improper neutralization of path-traversal sequences and absolute path components in user-supplied archive path input. The archive creation handler trusts the client-provided path and calls directory creation APIs without normalizing the target or enforcing a base directory. This aligns with [CWE-36] Absolute Path Traversal.
Attack Vector
The attack vector is network-based and requires low-privileged authenticated access to the Webbox interface. An attacker submits a crafted archive creation request containing traversal payloads or absolute paths. The server processes the request and creates the specified directory outside the intended scope. For a detailed exploitation walkthrough, refer to the Infoguard CVE Analysis.
Detection Methods for CVE-2026-54202
Indicators of Compromise
- Unexpected directories appearing under C:\Windows, C:\Program Files, or other users' profile folders on hosts running TeamDavid
- Webbox HTTP request logs containing traversal sequences such as ..\, ../, or absolute path prefixes in archive-related parameters
- Folder creation events attributed to the TeamDavid service account outside the configured archive root
Detection Strategies
- Review Webbox application and IIS logs for archive creation requests with suspicious path parameters
- Correlate Windows Security event ID 4656 and 4663 for directory creation outside the TeamDavid data directory
- Baseline the legitimate archive storage path and alert on any directory creation by the TeamDavid process outside that scope
Monitoring Recommendations
- Enable file system auditing on C:\Windows, C:\Users, and C:\Program Files for write and create-folder events
- Forward Webbox and Windows filesystem telemetry to a centralized SIEM for correlation
- Alert on repeated failed or anomalous archive creation attempts from a single authenticated session
How to Mitigate CVE-2026-54202
Immediate Actions Required
- Upgrade TeamDavid to a Rollout newer than 524 as published in the Tobit Release Notes
- Restrict Webbox access to trusted networks and authenticated users only
- Audit the TeamDavid host for unauthorized directories created outside the archive root
Patch Information
Tobit has addressed the issue in a subsequent Rollout after 524. Administrators should consult the Tobit Release Notes for the fixed version and apply the update. Additional technical context is available in the Infoguard CVE Analysis.
Workarounds
- Limit Webbox exposure by placing it behind a reverse proxy that filters path traversal sequences in archive parameters
- Run the TeamDavid service under a least-privileged account that lacks write access to C:\Windows and other users' directories
- Temporarily disable the archive creation feature until the patch is applied if operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
