What is CVE-2026-101893?

CVE-2026-101893 is a medium-severity vulnerability in Newell Brands Dymo Id, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.4/10. Published 2026-10-05.

How severe is CVE-2026-101893?

Medium severity. CVSS v3 base score is 4.4 out of 10.

XXE in Newell Brands Dymo Id

CVE-2026-101893

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

Vulnerability class: XXE (XML External Entity)

Published 2026-10-05 · last modified 2026-10-06.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Newell Brands Dymo Id

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

9119a7d8-5eab-497f-8521-727c672e3725 (release-notes)
9119a7d8-5eab-497f-8521-727c672e3725 (third-party-advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (vdb-entry)
9119a7d8-5eab-497f-8521-727c672e3725 (patch)

Frequently asked questions

What is CVE-2026-101893?: CVE-2026-101893 is a medium-severity vulnerability in Newell Brands Dymo Id, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.4/10. Published 2026-10-05.
How severe is CVE-2026-101893?: Medium severity. CVSS v3 base score is 4.4 out of 10.