CVE-2026-54207

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525

Description The move archive functionality (!ArcEntryMove) in the Webbox component processes the pathname parameter without proper validation. This allows an attacker to provide arbitrary paths, including Universal Naming Convention (UNC) paths, which trigger outbound connection attempts to external SMB servers. This behavior can lead to the exposure of NTLM authentication information, such as NTLM hashes, enabling SMB relay or credential theft attacks if outbound connections to port 445 are permitted. This issue can be exploited without authentication.

Recommendations Update to a version later than Rollout 524. Restrict outbound connections to port 445 (SMB) to minimize the risk of credential theft.