CVE-2026-54204: TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication.
This issue affects TeamDavid through Rollout 524.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify TeamDavid Webbox search functionality so the "pathnameroot" parameter is validated/rejected; prevent unauthenticated use of UNC paths ("\\Server\Share") that trigger outbound connections to attacker-controlled SMB servers (port 445/SMB).
TeamDavid Webbox (search functionality) pathnameroot parameter handling = reject/validate UNC network locations (e.g., "\\Server\Share") and block outbound SMB targets - Compensating control
Restrict outbound network access from the TeamDavid Webbox server so outbound connections to SMB (TCP port 445) are not permitted to untrusted networks/hosts, limiting exposure to SSRF/SMB relay/credential theft.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54204?
CVE-2026-54204 has a risk score of 62, indicating a moderate level of severity.
How do I fix CVE-2026-54204?
To fix CVE-2026-54204, ensure proper validation of the 'pathnameroot' parameter in the search functionality to prevent unauthorized network access.
What type of vulnerability is CVE-2026-54204?
CVE-2026-54204 is a Server-Side Request Forgery (SSRF) vulnerability.
What impact does CVE-2026-54204 have?
CVE-2026-54204 allows an attacker to make outbound connections to controlled network locations, potentially leading to data exposure.
Which software is affected by CVE-2026-54204?
CVE-2026-54204 affects the TeamDavid Webbox software by Tobit Laboratories AG.