{"schema":"threatline.record/2","record":{"id":"CVE-2026-102262","aliases":[],"summary":"Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control","details":"Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.","categories":["Unclassified"],"product":"DYMO ID","vendor":"Newell Brands","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102262","source_modified_at":"2026-10-11T17:05:29.450Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"DYMO ID","vendor":"Newell Brands","versions":[{"version":"1.5.1.71","status":"affected","lessThan":"1.6.0","versionType":"custom"},{"version":"1.6.0","status":"unaffected"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102262","source_modified_at":"2026-10-11T17:05:29.450Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"DYMO ID","ecosystem":null},"version":"1.6.0","basis":"first unaffected version stated in the CVE record"}],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0021,"percentile":0.10731,"score_date":"2026-10-23"},"published_at":"2026-10-05T20:37:26.019Z","modified_at":"2026-10-11T17:05:29.450Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102262","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T17:05:29.450Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102262","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm","tags":["release-notes"]},{"source":"CVE List","url":"https://www.dymo.com/support?cfid=user-guide","tags":["patch"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102262","tags":["vdb-entry"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-11T16:53:33.691895Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T17:05:29.450Z","content_hash":"3502239e75afda32fe461108d8119cb8b789e16b06e2a1fa6f22fd1c50af3e35"}}