{"schema":"threatline.record/2","record":{"id":"CVE-2026-101893","aliases":[],"summary":"Newell Brands DYMO ID document parsing failing file type extension authentication check","details":"Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.","categories":["Unclassified"],"product":"DYMO ID","vendor":"Newell Brands","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101893","source_modified_at":"2026-10-11T17:05:29.573Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"DYMO ID","vendor":"Newell Brands","versions":[{"version":"1.5.1.71","status":"affected","lessThan":"1.6.0","versionType":"custom"},{"version":"1.6.0","status":"unaffected"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101893","source_modified_at":"2026-10-11T17:05:29.573Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"DYMO ID","ecosystem":null},"version":"1.6.0","basis":"first unaffected version stated in the CVE record"}],"cvss":4.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00154,"percentile":0.04142,"score_date":"2026-10-23"},"published_at":"2026-10-05T20:36:21.380Z","modified_at":"2026-10-11T17:05:29.573Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101893","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T17:05:29.573Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101893","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm","tags":["release-notes"]},{"source":"CVE List","url":"https://www.dymo.com/support?cfid=user-guide","tags":["patch"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101893","tags":["vdb-entry"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-11T16:53:41.283786Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T17:05:29.573Z","content_hash":"ea17aaf8cc5da35fae5761ad066d23233ab9822e3dd779078b389a547d786b1d"}}