CVE-2026-12070 is an arbitrary file deletion vulnerability in Tobit Laboratories AG TeamDavid's Webbox. The issue arises from improper external control of file name or path (CWE-73) in the send email, fax, SMS, and related functionalities. By injecting an @@COMMENTFILE command into the scjob form field, an attacker with limited privileges can delete arbitrary files on the affected system. The vulnerability is present in TeamDavid versions up to and including Rollout 524. The CVSS 4.0 base score is 8.4, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on availability.

Successful exploitation allows an attacker with limited privileges to delete arbitrary files on the system hosting TeamDavid Webbox. This can lead to denial of service or disruption of normal operations by removing critical files. The vulnerability does not require user interaction and can be exploited remotely over the network. The impact on confidentiality and integrity is low, but availability impact is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and monitor for suspicious use of the scjob form field. Avoid exposing the vulnerable interface to untrusted networks. Follow up with Tobit Laboratories AG for updates on patches or official mitigations.