The move archive functionality (!ArcEntryMove) in Tobit Laboratories AG TeamDavid's Webbox accepts arbitrary path inputs without validation, including UNC network paths (e.g., \\Server\Share). This causes the server to make outbound SMB connection attempts to attacker-controlled endpoints. Because these connections can trigger NTLM authentication, attackers can potentially capture NTLM hashes or perform SMB relay attacks. Exploitation is possible without authentication. The vulnerability is identified as CVE-2026-54207 and affects versions through Rollout 524.

An attacker can cause the vulnerable server to authenticate to arbitrary SMB servers controlled by the attacker, potentially exposing NTLM authentication credentials such as hashes. This can facilitate SMB relay attacks or credential theft. The vulnerability does not require authentication to exploit, increasing its risk. The impact depends on whether outbound SMB connections (port 445) are allowed from the server's network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict outbound SMB (port 445) connections from the server to untrusted networks to prevent exploitation. Monitor network policies to block unauthorized SMB traffic. Avoid exposing the affected functionality to untrusted users or networks.