CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox  is vulnerable to a local file inclusion vulnerability in
 the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, 
which can then be downloaded by an authenticated user. A filter is in 
place that restricts access to the David con-fig folder and the user 
folder. However, this filter can be bypassed by specifying an alternate 
data stream, allowing the download of sensitive files such as other 
users' access files containing their passwords or the server's private 
key. This issue affects TeamDavid through Rollout 524.