CVE-2026-41124 is a path traversal vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.6, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70. A high privileged attacker with local access could exploit this flaw to gain unauthorized information exposure by bypassing pathname restrictions to access files outside restricted directories. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 2.3, reflecting low severity with local attack vector, low complexity, high privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available.

The vulnerability allows a high privileged local attacker to potentially access sensitive information by exploiting improper pathname restrictions. The impact is limited to information exposure without integrity or availability impact. The low CVSS score indicates the risk is relatively low and requires local high privilege access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity involving file access outside expected directories. No official remediation or temporary fix has been announced by Dell at this time.