The vulnerability exists in the link storing function of Tobit Laboratories AG TeamDavid, where a pathname parameter is interpreted without validation. If set to a UNC path such as \\Server\Share, the server initiates an outbound SMB connection to that location. An attacker can provoke this behavior, and because the server authenticates to the target SMB host, sensitive NTLM credentials may be revealed or transferred via SMB relay tactics. This flaw can be triggered without the need for authentication to the application, meaning any user with network access to the TeamDavid web server could exploit it if they can supply the pathname value.

Tobit Laboratories AG TeamDavid Webbox rolls out through version 524. All deployments of TeamDavid that include the vulnerable link‑storing feature and have outbound access to port 445 are affected. No other vendor products are affected.

The CVSS score of 6.3 indicates a moderate severity risk. EPSS is not provided, and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation yet. The attack vector relies on SSRF; an unauthenticated attacker can supply the pathname to trick the server into contacting an attacker‑controlled SMB endpoint. If the environment permits outbound SMB traffic, the attacker can capture NTLM hashes or perform a full SMB relay. The flaw is mitigated only by patching the software or restricting outbound SMB traffic from the server.