CVE-2026-54204 in TeamDavid
Summary
by MITRE • 08/07/2026
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication.
This issue affects TeamDavid through Rollout 524.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Tobit Laboratories AG TeamDavid's Webbox search functionality represents a critical server-side request forgery (ssrf) and credential exposure issue that leverages the pathnameroot parameter to execute unauthorized network operations. This flaw exists within the web application's handling of UNC paths, where the system accepts network location parameters without proper validation or sanitization, creating an attack vector that allows unauthenticated remote exploitation.
The technical implementation of this vulnerability stems from insufficient input validation and improper path handling within the Webbox search functionality. When attackers provide a pathnameroot parameter containing UNC paths such as "\\Server\Share", the server processes these network locations without verification, establishing outbound SMB connections to attacker-controlled endpoints. This behavior violates fundamental security principles of input sanitization and access control enforcement, creating a pathway for unauthorized network reconnaissance and credential harvesting.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to conduct sophisticated credential theft operations through NTLM authentication relay attacks. When the server attempts to authenticate to SMB endpoints specified in the pathnameroot parameter, it transmits NTLM hashes or other authentication credentials to the attacker-controlled servers, potentially compromising user accounts and system access. This vulnerability particularly affects environments where outbound connections to port 445 are permitted, as the attack requires successful SMB protocol communication to achieve its full impact.
The security implications align with CWE-918 (Server-Side Request Forgery) and can be categorized under ATT&CK technique T1078 (Valid Accounts) and T1567 (Server Software Component) within the adversary tactics framework. This vulnerability demonstrates how seemingly benign functionality can become a gateway for credential theft, authentication relay attacks, and lateral movement within network environments. The fact that exploitation requires no authentication credentials makes this particularly dangerous as it allows attackers to leverage the vulnerable application as an entry point for further compromise.
Organizations should implement immediate mitigations including input validation to reject UNC path parameters, disabling outbound SMB connections from affected servers, and implementing network segmentation to restrict access to port 445. The vulnerability affects TeamDavid through Rollout 524 and requires urgent patching or workaround implementation to prevent exploitation. Security monitoring should focus on detecting unusual outbound SMB connection patterns and authentication attempts to non-standard endpoints, as these behaviors indicate potential exploitation of this credential exposure vulnerability.