The vulnerability involves insufficient validation of file path parameters in the LoadImageAsPngBase64 endpoint of DYMO Connect Desktop's local web service. This allows an attacker to specify crafted paths to read image files from arbitrary locations on the host filesystem, beyond the intended scope. The vendor fixed the issue in version 1.6.2 by limiting access to files based on allowed image extensions only, not by directory. Consequently, arbitrary-location reads of files with permitted image extensions remain possible as an accepted residual risk.

An attacker with local access can read arbitrary image files on the host system if those files have allowed image extensions. This can lead to limited information disclosure but does not affect integrity or availability. The CVSS score is 4.0 (medium severity), reflecting low confidentiality impact and no impact on integrity or availability.

Upgrade to DYMO Connect Desktop version 1.6.2 or later, which implements file extension restrictions to limit the scope of file reads. Note that arbitrary reads of files with allowed image extensions outside intended directories remain possible by design, representing an accepted residual risk.