CVE-2026-102262CWE-22CWE-668path-traversal
CVE-2026-102262
High · published October 6, 2026
What it is
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
The record
Technical detail
- CVSS v3.1
- 7.3 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- 7.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00210 · 10.7th percentile
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-668 · Exposure of Resource to Wrong Sphere
- Published
- 2026-10-06T01:16Z
References (4)
EPSS history
Timeline