CVE-2026-101893: Newell Brands DYMO ID document parsing failing file type extension authentication check
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Newell Brands DYMO IDto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
DYMO ID version 1.5.1.71 is affected. Exposure occurs when a user browses a folder or network share containing a crafted file with a job-file extension recognized by the PC Job Files view, because the application automatically parses matching files.
What does an attacker need to exploit it?
An attacker needs to place a crafted job file on a location that the affected user browses, such as a network share. The issue has local attack vector and low privileges in the supplied severity vector; no user interaction beyond browsing the folder is indicated.
What can happen if exploitation succeeds?
A crafted file can cause server-side request forgery, capture NTLMv2 credentials, read local files, or crash the DYMO ID process.
What should be done if upgrading cannot happen immediately?
Avoid browsing untrusted folders or network shares with the PC Job Files view, and restrict write access to shares that users browse with DYMO ID. Upgrade to version 1.6.0 when possible.