CVE-2026-76796: Newell Brands DYMO Connect Desktop improper file path validation
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Newell Brands DYMO Connect Desktopto a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs local network access to the DYMO Connect Desktop local web service and must be able to submit requests to its LoadImageAsPngBase64 endpoint. No authentication or user interaction is indicated by the supplied severity vector.
What versions or configurations remain exposed after applying the fix?
Version 1.6.2 is identified as the fix. The documented residual risk is that the endpoint still permits reads from arbitrary filesystem locations when the target file has an allowed image extension; the fix restricts file extensions rather than directories.
What can be done if upgrading is not immediately possible?
The provided information does not identify a configuration workaround. Reduce exposure by preventing untrusted parties from reaching the local web service and avoid processing attacker-controlled file paths through the endpoint.
How can I determine whether the issue applies to an installation?
Check whether DYMO Connect Desktop is earlier than 1.6.2 and whether its local web service exposes the LoadImageAsPngBase64 endpoint. Even on 1.6.2, assess whether image files with permitted extensions are stored in locations that should not be readable through that service.