Dell PowerProtect Data Domain Path Traversal (Local) 7.7.1.0-8.8, LTS2024-2026
CVE-2026-90726 Published on October 27, 2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Vulnerability Analysis
CVE-2026-90726 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.
Weakness Type
Path Traversal: '..\filedir'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that can resolve to a location that is outside of that directory.
Affected Versions
Dell PowerProtect Data Domain:- Before 8.9.0.0 or later is affected.
- Before 7.13.1.90 or later is affected.
- Before 8.3.1.50 or late is affected.
- Before 8.6.1.30 or later is affected.