Description
Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are
vulnerable to a buffer overflow condition. By specifying an excessively
long filename in a file upload request, an unauthenticated attacker can
trigger a crash of the server, resulting in a denial of service.
Depending on the stack state or if a stack canary can be disclosed
through another vulnerability, this buffer overflow could potentially be
exploited for remote code execution, leading to full compromise of the
server. This issue affects TeamDavid through Rollout 524.
Published: 2026-08-07
Score: 9.5 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a classic buffer overflow in the handling of file names during uploads. An attacker can craft an overlong name to crash the server. If a stack canary leak or an additional vulnerability is present, the overflow could be leveraged for arbitrary code execution, giving the attacker full control.

Affected Systems

The Tobit Laboratories AG TeamDavid Webbox application is the affected product. Versions up to Rollout 524 are vulnerable, and any environment that hosts TeamDavid and exposes the upload endpoints is susceptible.

Risk and Exploitability

With a CVSS score of 9.5, the severity is high. No EPSS data is currently available, but the vulnerability can be triggered by unauthenticated attackers via normal web traffic. The issue is not listed in CISA KEV yet, but its nature suggests potential for exploitation. Because the overflow occurs in a public-facing upload service, the attack vector is likely network based.

Generated by OpenCVE AI on August 7, 2026 at 11:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the latest TeamDavid release that resolves the file‑name buffer overflow.
  • If an update cannot be applied immediately, disable or restrict the upload functionality for unauthenticated users until the fix is available.
  • Enforce strict size limits on incoming file names and implement additional boundary checks in the web application firewall to prevent requests that exceed acceptable thresholds.
  • Monitor logs for anomalous upload attempts and configure alerts for repeated upload failures or crashes.

Generated by OpenCVE AI on August 7, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Tobit Laboratories Ag
Tobit Laboratories Ag teamdavid
Vendors & Products Tobit Laboratories Ag
Tobit Laboratories Ag teamdavid

Fri, 07 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Description Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.
Title TeamDavid: Buffer Overflow in file names of file upload functionalities
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Tobit Laboratories Ag Teamdavid
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-08-07T09:46:23.246Z

Reserved: 2026-06-12T09:32:46.514Z

Link: CVE-2026-54210

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T11:30:03Z

Weaknesses