Filtered by vendor Newell Brands
Subscriptions
Filtered by product Dymo Connect Desktop
Subscriptions
Total
1 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76796 | 1 Newell Brands | 1 Dymo Connect Desktop | 2026-09-22 | 4 Medium |
| The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk). | ||||
Page 1 of 1.