CVE-2026-101893

4.4 MEDIUM

Published 2026-10-05 · Updated 2026-10-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weaknesses

CWE-611

All references

https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json
https://www.cve.org/CVERecord?id=CVE-2026-101893
https://www.dymo.com/support?cfid=user-guide

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10025
HIGHCVE-2026-102127PoC
HIGHCVE-2026-102155
HIGHCVE-2026-106616
HIGHCVE-2026-109430
MEDIUMCVE-2026-14304PoC
HIGHCVE-2026-14905
HIGHCVE-2026-17646

Related by shared AI tags and CWE weakness class. Browse the full archive.