CVE-2026-101893

Newell Brands DYMO ID document parsing failing file type extension authentication check

State: Published
Severity: 5.1 Medium
Published: Oct 5, 2026
Updated: Oct 11, 2026
Reserved: Sep 28, 2026

Description

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N	cisa-cg
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L	cisa-cg

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
DYMO IDNewell Brands	1.5.1.71 to before 1.6.0Affected 1.6.0Not affected

References

urlrelease-notes
urlpatch
urlthird-party-advisory
urlvdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.