The vulnerability identified as CVE-2026-12070 in Tobit Laboratories AG TeamDavid's Webbox allows an attacker with limited privileges to delete arbitrary files on the system. This is achieved by injecting an @@COMMENTFILE command into the scjob form field used in the send email, fax, SMS, and related functionalities. The issue affects versions of TeamDavid up to and including Rollout 524. The CVSS 4.0 base score is 8.4, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with limited privileges to delete arbitrary files on the affected system, potentially disrupting service availability and causing data loss. The vulnerability impacts the availability of the system and requires no user interaction to exploit. The attack can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality and monitor for suspicious activity related to the scjob form field. Avoid exposing the vulnerable interface to untrusted networks or users.