CVE-2026-12070 in TeamDavid
Summary
by MITRE • 08/07/2026
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 524.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in Tobit Laboratories AG TeamDavid's Webbox represents a critical arbitrary file deletion flaw that exists within the email, fax, and SMS sending functionality of the system. This weakness allows malicious actors to exploit the scjob form field by injecting the @@COMMENTFILE command, thereby gaining unauthorized access to the underlying file system and enabling them to delete any file present on the server. The vulnerability specifically impacts TeamDavid Webbox versions through Rollout 524, indicating that this flaw has persisted across multiple releases, suggesting inadequate security testing or patch management processes within the development lifecycle.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization within the web application's form processing mechanisms. When the scjob parameter is processed without proper authorization checks or file path validation, the system interprets the @@COMMENTFILE command as a legitimate directive to manipulate files on the server. This type of vulnerability falls under the CWE-22 category of Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal, which allows attackers to access files outside the intended directory structure. The flaw demonstrates poor security design principles where user-supplied input directly influences system operations without adequate sanitization or access controls.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations using TeamDavid Webbox systems. An attacker who successfully exploits this vulnerability could delete critical system files, configuration data, email archives, fax logs, or even the application itself, leading to complete service disruption and potential data loss. The ability to delete any file on the system creates a pathway for attackers to escalate their privileges, remove security monitoring tools, or corrupt essential application components that would require extensive recovery efforts. This vulnerability also poses significant risks to data integrity and business continuity, as it could be leveraged to permanently destroy valuable information assets.
Organizations utilizing TeamDavid Webbox systems should immediately implement comprehensive mitigations to address this vulnerability. The primary remediation involves implementing strict input validation and sanitization for all user-supplied parameters, particularly those used in file manipulation operations. Access controls must be enforced to ensure that only authorized users can execute file deletion commands, and the @@COMMENTFILE functionality should be either disabled or heavily restricted when processing external inputs. Additionally, organizations should conduct thorough security assessments of their web applications to identify similar vulnerabilities and implement proper application-level firewalls or intrusion detection systems. This vulnerability aligns with several ATT&CK techniques including T1059 Command and Scripting Interpreter and T1485 Data Destruction, emphasizing the need for layered defensive measures. System administrators should also review and update their patch management processes to ensure timely deployment of vendor security updates and maintain detailed monitoring of file system activities to detect potential exploitation attempts.