CVE-2026-12070

HIGH

CVE: CVE-2026-12070 - Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etcSign in to save

CVSS

8.4

CVSS v4.0

EPSS

0.2%

Exploit Prediction Score

Published

August 7, 2026

Exploitability

EPSS probability 0.2%

Description

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 524.

Weaknesses

CWE-73

Affected Packages

No package data available.

Aliases

CVE-2026-12070

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://david.tobit.software/releasenotes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/