CyberRota Analysis
AI-GeneratedThe LoadImageAsPngBase64 endpoint in the Newell Brands DYMO Connect Desktop local web service is vulnerable due to insufficient validation of the file path parameter, enabling attackers to read arbitrary image files from the host filesystem. While the fix in version 1.6.2 restricts access by file extension, it does not prevent access to files located in arbitrary directories, leaving a residual risk. Organizations using this service should prioritize patching to mitigate potential exposure to sensitive data.
Original NVD Description
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk).