CVE-2026-101893

Received Received - Intake

DYMO ID Job File SSRF and File Read Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-101893

Affected Vendors & Products

Vendor	Product	Version / Range
Newell	Brands	DYMO ID 1.5.1.71

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

Newell Brands DYMO ID 1.5.1.71 has an XML External Entity (XXE) vulnerability due to unsafe XML parsing. The software uses XmlDocument.Load() without disabling DTD processing, allowing crafted files to trigger SSRF, credential theft, or local file reads when browsing network shares.

Detection Guidance

Detecting this vulnerability requires checking for outdated DYMO ID versions (below 1.6.0) and monitoring for suspicious file parsing activities. Review network shares for unauthorized job files and inspect system logs for crashes or unusual XML processing. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive files on your system, steal NTLMv2 credentials via crafted files, or perform server-side requests to internal systems. The vulnerability is triggered automatically when browsing folders containing malicious files.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade DYMO ID to version 1.6.0 or later to address the XML parsing issue. Disable automatic parsing of job files if possible. Restrict access to network shares containing job files and monitor for SSRF or credential capture attempts.

Hi! I’m here to help you understand CVE-2026-101893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70