CVE-2026-54208 describes an improper input validation vulnerability (CWE-20) in Tobit Laboratories AG TeamDavid's Webbox application. The flaw permits unauthenticated attackers to write arbitrary files on the server because user input is directly written to files without validation or restrictions on file types. This enables attackers to create files containing malicious JavaScript, resulting in stored cross-site scripting (XSS) when accessed by users. The vulnerability affects TeamDavid through Rollout 524. The CVSS 4.0 base score is 8.5, indicating high severity. No patch or official remediation level has been disclosed.

An unauthenticated attacker can exploit this vulnerability to write arbitrary files on the server, potentially creating malicious files that trigger stored cross-site scripting (XSS) attacks against users. This can lead to client-side code execution in the context of the affected application, compromising user data confidentiality and integrity. The vulnerability does not require authentication and has a low attack complexity, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected Webbox application and monitor for suspicious file creation activities. Avoid exposing the vulnerable component to untrusted networks if possible.