The flaw originates from the TeamDavid websearch feature’s ‘pathnameroot’ parameter, which accepts UNC paths without validation. When an attacker supplies a path such as `\\Server\\Share`, the server attempts to connect to that SMB share on port 445, automatically authenticating with NTLM and potentially leaking NTLM hashes. This Server‑Side Request Forgery can therefore expose the server’s credentials and enable credential‑stealing or SMB‑relay attacks. The vulnerability is fully exploitable without authentication and is categorized as CWE‑20 and CWE‑918, with a CVSS score of 7.7 indicating significant risk.

Affected installations of the Tobit Laboratories AG TeamDavid platform are those that have not yet migrated to Rollout 528 (June 30 2026). In that release the search functionality that accepts a ‘pathnameroot’ parameter is disabled by default, removing the SSRF surface; therefore systems on or after Rollout 528 are no longer exposed to this flaw.

An attacker can trigger the SSRF by sending a crafted search request containing a UNC path. No authentication is required, and if outbound SMB traffic is permitted, the server may authenticate to a remote SMB endpoint, allowing the attacker to capture NTLM hashes or use the machine as a relay for further attacks. The EPSS score of less than 1 % indicates a very low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The risk level is therefore moderate to high for pre‑Rollout 528 installations, but it effectively disappears for newer versions where the functionality is disabled by default.