An unauthenticated attacker can send input that the TeamDavid Webbox application writes directly to server files without any validation or restriction on file names or extensions. As a result the attacker can create or overwrite files such as .htm with malicious JavaScript. When a user later loads one of these files, the browser executes the injected script, producing a stored cross‑site scripting condition that can be used to hijack the victim’s session, deface the site or perform other client‑side attacks. The impact is limited to the scope of the compromised user’s browser but can be as severe as full account takeover.

The flaw is present in Tobit Laboratories AG’s TeamDavid Webbox application before Rollout 528. The vulnerability resides in the file‑write handling code of the Webbox component, which does not enforce file‑type restrictions or content validation for user‑supplied paths.

The CVSS score of 8.5 classifies the issue as high severity. Because the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, there is no evidence of current exploitation but a significant theoretical risk remains. The likely attack vector is inferred to be network‑based: any unauthenticated user who can reach the web interface can trigger the file write and subsequent XSS. Network access to the exposed service is sufficient to supply the malicious input, and no privileged access or additional exploits are required.