CVE-2026-54214

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525

Description The Webbox application is susceptible to HTTP header injection via the cType URL parameter. The application fails to properly restrict control characters, such as colons or URL-encoded newlines (%0a), allowing the modification of the Content-Type header in HTTP responses. This flaw enables attackers to inject additional headers, such as extra Location headers, which can lead to an open redirect.

Recommendations Update TeamDavid to a version later than Rollout 524. As a temporary mitigation, restrict or sanitize the use of the cType parameter in URL requests.