Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-102262

Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Newell Brands DYMO ID

Default version status: unknown

  • 1.5.1.71 to < 1.6.0affected
  • 1.6.0unaffected

References