CVE-2026-76796

Awaiting Analysis Awaiting Analysis - Queue

Newell Brands DYMO Connect Desktop Local File Read

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76796

EUVD

EUVD-2026-79626

Affected Vendors & Products

Vendor	Product	Version / Range
newell_brands	dymo_connect_desktop	1.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

The LoadImageAsPngBase64 endpoint in Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without proper validation. This allows an attacker to craft a path that reads arbitrary image files from the host filesystem outside the intended scope. The vulnerability exists because the service does not restrict file access to specific directories, only by file extension.

Detection Guidance

This vulnerability involves arbitrary file reads via the LoadImageAsPngBase64 endpoint in DYMO Connect Desktop. To detect it, monitor network traffic for requests to the local web service (typically on localhost) targeting this endpoint with file path parameters. Check for unusual file reads outside expected directories.

Impact Analysis

This vulnerability could allow an attacker with local access to read sensitive image files on your system, potentially exposing confidential or personal data. Since the service runs locally, it may also be exploited by malware or unauthorized users on the same machine to access files they should not be able to.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, which may violate GDPR (General Data Protection Regulation) by exposing personal information without consent. For HIPAA (Health Insurance Portability and Accountability Act), it could risk exposure of protected health information, leading to compliance violations and potential penalties.

Mitigation Strategies

Update DYMO Connect Desktop to version 1.6.2 or later to address the vulnerability. Avoid using the LoadImageAsPngBase64 endpoint with untrusted file paths.

Hi! I’m here to help you understand CVE-2026-76796. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70