Skip to content
OpenAdvisories
Medium VA-26-258-01 1 CVE

Newell Brands DYMO Connect Desktop improper file path validation

Published Sep 15, 2026 · Updated Sep 15, 2026

Vendor: Newell Brands Product: DYMO Connect Desktop

Summary

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope.

Vulnerabilities 1

  • Medium 4.0
    CVE-2026-76796

    Newell Brands DYMO Connect Desktop improper file path validation

    The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope.…

    Newell Brands DYMO Connect Desktop

Revision history

  1. #1.0.0

    Initial publication