{"id":"CVE-2026-54210","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-54210","generatedAt":"2026-10-28T08:11:12.939Z","title":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition.","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","published":"2026-08-07T10:16:58.000Z","lastModified":"2026-10-24T16:10:00.000Z","status":"Deferred","sourceIdentifier":"vulnerability@ncsc.ch","cvss":{"version":"4.0","score":9.5,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-787"],"affected":[],"epss":{"score":0.00665,"percentile":0.51592,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://chayns.net/77892-10814/tapp/763210?postId=11454","source":"vulnerability@ncsc.ch"},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","source":"vulnerability@ncsc.ch"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-54210","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}