CVE-2026-54200 describes a local file inclusion vulnerability in Tobit Laboratories AG TeamDavid's Webbox, specifically in the functionality for sending emails, faxes, SMS, and similar messages. The vulnerability arises from the ability to specify an '@@attach' command in the 'scjob' form field, which attaches files to messages. An existing filter restricts access to the David config folder and user folders; however, this filter can be bypassed by using alternate data streams. This bypass enables an authenticated user to download sensitive files, including other users' access files containing passwords and the server's private key. The issue affects versions of TeamDavid up to and including Rollout 524. No official remediation or patch has been documented as of the published date.

The vulnerability allows an authenticated user to bypass file access restrictions and download sensitive files from the server, including other users' password files and the server's private key. This could lead to unauthorized access to user credentials and compromise of the server's security. The CVSS 4.0 score of 8.4 indicates a high severity impact with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality and security capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the affected functionality to trusted users only and consider additional access controls or network segmentation to limit exposure. Avoid exposing the vulnerable Webbox component to untrusted networks until a fix is available.