CVE-2026-54214
TeamDavid: Header Injection through the 'cType' URL parameter
Description
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
INFO
Published Date :
Aug. 7, 2026, 10:16 a.m.
Last Modified :
Oct. 24, 2026, 4:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-54214
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 455daabc-a392-441d-aa46-37d35189897c | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Validate the cType URL parameter for control characters.
- Sanitize input to prevent header injection.
- Implement strict Content-Type validation.
- Update TeamDavid to Rollout 524 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54214.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54214 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54214
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54214 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54214 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Changed Translation Title: TeamDavid de Tobit Laboratories AG, Description: La aplicación Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a la inyección de encabezados HTTP a través del parámetro URL ’cType’, lo que permite la modificación arbitraria del encabezado Content-Type en las respuestas HTTP. Debido a que el parámetro no restringe adecuadamente los caracteres de control como los saltos de línea codificados en URL (’%0a’) o los dos puntos, los atacantes pueden inyectar encabezados adicionales, incluyendo encabezados Location extra, en la respuesta del servidor. Esto resulta, por ejemplo, en una vulnerabilidad de redirección abierta. Este problema afecta a TeamDavid hasta el Rollout 524. Title: TeamDavid de Tobit Laboratories AG, Description: La aplicación Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a la inyección de encabezados HTTP a través del parámetro URL ’cType’, lo que permite la modificación arbitraria del encabezado Content-Type en las respuestas HTTP. Debido a que el parámetro no restringe adecuadamente los caracteres de control como los saltos de línea codificados en URL (’%0a’) o los dos puntos, los atacantes pueden inyectar encabezados adicionales, incluyendo encabezados Location extra, en la respuesta del servidor. Esto resulta, por ejemplo, en una vulnerabilidad de redirección abierta. Este problema afecta a TeamDavid hasta el Rollout 524. -
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: TeamDavid de Tobit Laboratories AG, Description: La aplicación Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a la inyección de encabezados HTTP a través del parámetro URL ’cType’, lo que permite la modificación arbitraria del encabezado Content-Type en las respuestas HTTP. Debido a que el parámetro no restringe adecuadamente los caracteres de control como los saltos de línea codificados en URL (’%0a’) o los dos puntos, los atacantes pueden inyectar encabezados adicionales, incluyendo encabezados Location extra, en la respuesta del servidor. Esto resulta, por ejemplo, en una vulnerabilidad de redirección abierta. Este problema afecta a TeamDavid hasta el Rollout 524. -
CVE Modified by [email protected]
Sep. 07, 2026
Action Type Old Value New Value Changed Description Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524. Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/54xxx/CVE-2026-54214.json">CVE-2026-54214</a> Added Reference https://chayns.net/77892-10814/tapp/763210?postId=11454 Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ Removed Reference https://david.tobit.software/releasenotes Removed Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 07, 2026
Action Type Old Value New Value Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ Removed Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 07, 2026
Action Type Old Value New Value Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ Added SSVC {'id': 'CVE-2026-54214', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-07T11:25:40.877413Z'} -
New CVE Received by [email protected]
Aug. 07, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Tobit Laboratories AG', 'modules': ['Webbox'], 'product': 'TeamDavid', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': 'Rollout 524'}], 'defaultStatus': 'unaffected'}] Added Description Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-601 Added Reference https://david.tobit.software/releasenotes Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/