{"id":"CVE-2026-12071","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-12071","generatedAt":"2026-10-28T06:14:24.607Z","title":"By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD).","description":"The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as “%2e” (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n“.com” is the application’s domain, and “.company” is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious “.company” domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","published":"2026-08-07T10:16:56.000Z","lastModified":"2026-10-23T21:10:00.000Z","status":"Deferred","sourceIdentifier":"vulnerability@ncsc.ch","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-601"],"affected":[],"epss":{"score":0.00458,"percentile":0.39567,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://chayns.net/77892-10814/tapp/763210?postId=11454","source":"vulnerability@ncsc.ch"},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","source":"vulnerability@ncsc.ch"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12071","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}