CVE-2026-54217 is a stored XSS vulnerability in Tobit Laboratories AG TeamDavid's Webbox application. The vulnerability arises from improper input validation (CWE-20), allowing an attacker to embed malicious JavaScript code within an email. When a user accesses the infected email, the stored script executes, potentially leading to client-side code execution. The issue affects versions of TeamDavid through Rollout 524. No official remediation or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing a malicious email. This can lead to session hijacking, information disclosure, or other client-side impacts typical of stored XSS vulnerabilities. The CVSS score of 5.3 reflects a medium impact with network attack vector, low complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening emails from untrusted sources. No official remediation or temporary fix has been documented at this time.