CVE-2026-54202 describes an absolute path traversal vulnerability (CWE-36) in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality. The issue stems from insufficient validation of user-controlled input for the archive path, enabling an attacker to manipulate the path to traverse directories and create folders in arbitrary filesystem locations, including sensitive system directories like C:\Windows or user directories. This vulnerability affects TeamDavid through Rollout 524. The CVSS 4.0 base score is 8.5, indicating high severity. No known exploits in the wild or vendor remediation details are currently available.

Successful exploitation allows an attacker with at least low privileges to create directories in arbitrary locations on the affected system, potentially including sensitive system directories. This could facilitate further attacks or persistence mechanisms by placing files in locations normally restricted. The vulnerability impacts confidentiality and integrity with high attack vector and low attack complexity, but requires some privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the archive creation functionality to trusted users only and monitor for suspicious activity related to directory creation. Avoid exposing the vulnerable component to untrusted users.