CVE-2026-54202 is an absolute path traversal vulnerability (CWE-36) in Tobit Laboratories AG TeamDavid's Webbox archive creation feature. Due to insufficient validation of user-controlled archive paths, an attacker can manipulate input to traverse directories and create folders in arbitrary locations on the filesystem, including sensitive directories like C:\Windows or user directories. This vulnerability affects TeamDavid through Rollout 524. No patch or official remediation guidance has been published yet. The CVSS 4.0 base score is 8.5, indicating high severity.

An attacker with at least low privileges can exploit this vulnerability to create directories in arbitrary locations on the affected system. This could lead to unauthorized modification of the filesystem structure, potentially enabling further attacks or disruption of system operations. The vulnerability affects sensitive directories such as C:\Windows, which could impact system stability or security if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Until a patch is available, restrict access to the archive creation functionality to trusted users only and monitor for suspicious activity related to directory creation.