CVE-2026-12071

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525

Description The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as %2e (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection.

Recommendations Update TeamDavid to a version later than Rollout 524.