{"id":"CVE-2026-54210","aliases":["EUVD-2026-54441","GHSA-rghw-4g53-4wwv"],"status":"published","title":"TeamDavid: Buffer Overflow in file names of file upload functionalities","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00665,"percentile":0.52252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-08-07T09:46:23Z","modified":"2026-10-24T16:10:00Z","products":[{"vendor":"tobit laboratories ag","product":"teamdavid"}],"references":[{"url":"https://chayns.net/77892-10814/tapp/763210?postId=11454","tags":["release-notes"]},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54210"},{"url":"https://david.tobit.software/releasenotes"},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative"},{"url":"https://github.com/advisories/GHSA-rghw-4g53-4wwv"}],"sources":{"cve":[{"id":"CVE-2026-54210","title":"TeamDavid: Buffer Overflow in file names of file upload functionalities","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","status":"published","published":"2026-08-07T09:46:23.246Z","modified":"2026-09-07T12:56:54.726Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-54441","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","status":"published","published":"2026-08-07T09:46:23Z","modified":"2026-09-07T12:56:54Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-rghw-4g53-4wwv","title":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload...","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid through Rollout 524.","status":"published","published":"2026-08-07T12:32:00Z","modified":"2026-09-07T15:34:47Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:11:27.182088Z"}],"nvd":[{"id":"CVE-2026-54210","description":"Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are \nvulnerable to a buffer overflow condition. By specifying an excessively \nlong filename in a file upload request, an unauthenticated attacker can \ntrigger a crash of the server, resulting in a denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","status":"published","published":"2026-08-07T10:16:58.03Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}