PatchTheCEVCVE-2026-54214: Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cTyp
28
Routine
MEDIUM 5.3
CVE-2026-54214 is a medium-severity flaw (CVSS 5.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. i
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Passive |
| EPSS exploit chance | 0.5% (top 61%) |
| CISA exploited list | No |
| Weakness | CWE-601 |
| Published | 2026-08-07 |
| Last modified | 2026-10-23 |
Publisher (CNA): Switzerland Government Common Vulnerability Program
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.