CVE-2026-12070

UNKNOWN 0.0

TeamDavid: Arbitrary File Deletion via form field 'scjob'

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CWE	CWE-73
Vendor	tobit laboratories ag
Product	teamdavid
Published	Aug 7, 2026
Last Updated	Sep 7, 2026

Stay Ahead of the Next One

Get instant alerts for tobit laboratories ag teamdavid

Be the first to know when new unknown vulnerabilities affecting tobit laboratories ag teamdavid are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Tobit Laboratories AG / TeamDavid

0 < Rollout 528

References

NVD ↗ CVE.org ↗ EPSS Data ↗

chayns.net: https://chayns.net/77892-10814/tapp/763210?postId=11454 labs.infoguard.ch: https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Credits

Dario Weiss of InfoGuard Labs