CVE-2026-102262 — Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / …
Published: 2026-10-05 · CVSS: 7.0 · CVSS 4.0
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7