Executive brief
DYMO Connect Desktop is a local application used for designing and printing labels. Its built-in web service contains an endpoint that fails to properly validate file paths, allowing an attacker with local access to read arbitrary image files from the computer's filesystem, potentially exposing sensitive documents or data stored as image files.
Technical details
The LoadImageAsPngBase64 endpoint in DYMO Connect Desktop's local web service performs insufficient validation on a user-supplied file path parameter (CWE-73: External Control of File Name or Path). The vulnerable code accepts crafted paths that allow traversal outside the intended directory scope, enabling arbitrary reads of image files from the host filesystem. Attack requires local network access to the web service and does not require authentication. An attacker can leverage this to extract sensitive image files from the system. A fix was released in version 1.6.2, though the patch limits access by file extension only—files with permitted image extensions at arbitrary locations remain readable by design (accepted residual risk).
Affected products
- Newell Brands DYMO Connect Desktop <1.6.2
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 1.6.2