The vulnerability in Tobit Laboratories AG TeamDavid's Webbox application arises from improper input validation (CWE-20), allowing unauthenticated attackers to perform arbitrary file writes on the server. User input is written directly to files without validation or restrictions on file types, enabling attackers to create or overwrite files (e.g., .htm) containing malicious JavaScript. This leads to stored cross-site scripting (XSS) when users access these attacker-controlled files. The vulnerability affects versions of TeamDavid through Rollout 524. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can create or overwrite files on the server with attacker-controlled content, potentially leading to stored cross-site scripting (XSS) attacks against users who access these files. This can result in execution of malicious scripts in the context of the victim's browser, potentially compromising user data or session integrity. The CVSS 4.0 score of 8.5 indicates a high severity impact with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious file creation. Avoid exposing the vulnerable Webbox application to untrusted networks where possible.