CVE-2026-54199 describes an improper input validation vulnerability (CWE-20) in Tobit Laboratories AG TeamDavid's Webbox, specifically in the link storing functionality accessed via //ServerClient_celink.htm. The application appends user-supplied data from the request body directly to the redirect target in a 302 HTTP response. If an attacker includes a line feed character in the input, it is also included in the HTTP response headers, enabling HTTP header injection. This vulnerability affects TeamDavid through Rollout 524. The CVSS 4.0 base score is 5.3, indicating a medium severity. No patch or remediation level has been published by the vendor, and no known exploits are reported in the wild.

An attacker can inject arbitrary HTTP headers by manipulating the redirect target in the 302 response, potentially leading to HTTP response splitting or other header injection attacks. This could affect the integrity of HTTP responses and may facilitate further attacks such as cache poisoning or cross-site scripting in some scenarios. However, the impact is limited by the medium CVSS score and the requirement for user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid exposing the vulnerable functionality or implement input validation and sanitization on the client side if possible. Monitor vendor communications for updates on official fixes.