Read the docs
TI-2026-68266 Aliases CVE-2026-102262GHSA-gmvp-63rm-744w

Path traversal in Newell Brands DYMO ID lets attackers run code

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Newell Brands DYMO ID from 1.5.1.71 before 1.6.0 resolves its plugin Modules directory relative to the process working directory. This exposes a resource to the wrong sphere (CWE-668), so a file location the attacker controls can be treated as trusted. A local attacker with low privileges can get code execution at the victim's privilege level if the victim clicks a job file the attacker placed alongside malicious modules or a DLL.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed DYMO ID (Newell Brands): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Newell BrandsDYMO ID1.5.1.71 to before 1.6.01.6.0Patch availableCNA
  • DYMO ID VendorNewell Brands Affected 1.5.1.71 to before 1.6.0 Fixed in 1.6.0 Patch available CNA

Remediation

Upgrade Newell Brands DYMO ID to version 1.6.0, the fixed version for this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA DYMO ID (Newell Brands) Fixed in 1.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Newell Brands DYMO ID 1.6.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-68265 XML external entity flaw in Newell Brands DYMO ID file parsingPriority LOW 22
    Show all 2 records →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-102262
  2. 2026-10-06 Alias added: GHSA-gmvp-63rm-744w
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 2

  • TI-2026-53653 Newell Brands DYMO Connect Desktop improper file path validation CVSS 4.0MEDIUM 5.1
  • TI-2026-68265 XML external entity flaw in Newell Brands DYMO ID file parsing CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences