CVE-2026-101893
Newell Brands DYMO ID document parsing failing file type extension authentication check
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.
| CWE | CWE-611 |
| Vendor | newell brands |
| Product | dymo id |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for newell brands dymo id
Be the first to know when new medium vulnerabilities affecting newell brands dymo id are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low
Affected Versions
Newell Brands / DYMO ID
1.5.1.71 < 1.6.0
References
mediaserver.newellrubbermaid.com: https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm dymo.com: https://www.dymo.com/support?cfid=user-guide raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json cve.org: https://www.cve.org/CVERecord?id=CVE-2026-101893
Credits
Paweล Karwowski, GetResponse S.A. Bartosz Nowicki, GetResponse S.A.