---
id: "CVE-2026-90721"
kind: "vulnerability"
aliases: ["CVE-2026-90721"]
title: "Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of service"
severity: "low"
cvss: 3.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect"]
not_affected_if: ["default-config"]
published_at: "2026-10-28T09:17:08+00:00"
first_seen_at: "2026-10-28T09:32:03+00:00"
updated_at: "2026-10-28T09:34:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90721", "first_seen_at": "2026-10-28T09:32:03+00:00"}]
---

# Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of service

Several Dell PowerProtect Data Domain release lines contain a path traversal flaw. A high-privileged attacker with local access could use it to cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS release against the affected ranges in the Dell advisory: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20.

## Fix

- Move to a fixed Data Domain OS release as named in the Dell security advisory; the exact fixed versions are unknown from the sources.

## Timeline

- 2026-10-28T09:32:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90721

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_