CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an 
unauthenticated attacker to create or write into existing files on the 
server with attacker-controlled content. This is possible because user 
input is written directly to files without proper validation or 
restriction on file types. As a result, an attacker can create files 
(e.g., .htm), containing malicious JavaScript code. When a user accesses
 a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524.