Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-101893

Newell Brands DYMO ID document parsing failing file type extension authentication check

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Newell Brands DYMO ID

Default version status: unknown

  • 1.5.1.71 to < 1.6.0affected
  • 1.6.0unaffected

References