Vulnerability · Published Aug 7, 2026 · Assigned by NCSC.ch

CVE-2026-54200TeamDavid: Local File Inclusion via the form field 'scjob'

High 8.4

In plain English

A high-severity security flaw in TeamDavid from Tobit Laboratories AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user. A filter is in place that restricts access to the David con-fig folder and the user folder. However, this filter can be bypassed by specifying an alternate data stream, allowing the download of sensitive files such as other users' access files containing their passwords or the server's private key. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Affected products (as reported)

Vendor	Product	Versions
Tobit Laboratories AG	TeamDavid	0 – before Rollout 528

Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:L

References

https://chayns.net/77892-10814/tapp/763210?postId=11454 release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ third-party-advisory