CVE-2026-54199

UNKNOWN 0.0

TeamDavid: Header Injection through request body in link storing functionality

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to the redirect link, resulting in the ability to control the response headers. This issue affects TeamDavid through Rollout 524.

CWE	CWE-20
Vendor	tobit laboratories ag
Product	teamdavid
Published	Aug 7, 2026

Stay Ahead of the Next One

Get instant alerts for tobit laboratories ag teamdavid

Be the first to know when new unknown vulnerabilities affecting tobit laboratories ag teamdavid are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Tobit Laboratories AG / TeamDavid

0 ≤ Rollout 524

References

NVD ↗ CVE.org ↗ EPSS Data ↗

david.tobit.software: https://david.tobit.software/releasenotes labs.infoguard.ch: https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Credits

Dario Weiss of InfoGuard Labs