CVE-2026-12070CWE-73

CVE-2026-12070

published August 7, 2026

CVSS
8.4
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion

vulnerability in the send email, fax, SMS, etc. functionality. By

specifying an @@COMMENTFILE command in the form field scjob, any file on

the system can be deleted. This issue affects TeamDavid before Rollout 528.

Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-07T14:16Z
References (2)
https://chayns.net/77892-10814/tapp/763210?postId=11454 · [email protected]https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ · [email protected]
EPSS history
Timeline
  • 07 AUG 09:40Z
    TeamDavid: Arbitrary File Deletion via form field 'scjob'
    cvelistv5