Vulnerability · Published Oct 5, 2026 · Assigned by cisa-cg
CVE-2026-102262Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
High 7.3
In plain English
A high-severity path traversal in DYMO ID from Newell Brands. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Newell Brands | DYMO ID | 1.5.1.71 – before 1.6.0 |
Weakness: CWE-668, CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H