Dell Application Store prior to version 26.05.0.7 contains an uncontrolled path element flaw. A local attacker with low privileges can supply a specially crafted path that the application resolves without adequate validation, enabling the attacker to overwrite or create files in arbitrary directories and execute code with higher privileges. The vulnerability can lead to complete compromise of the affected system, allowing the attacker to gain administrative control, install malware, or alter system configurations.

The vulnerability affects Dell Application Store deployments running any version earlier than 26.05.0.7. Systems using the Dell Application Store component, regardless of other software, are susceptible because the flaw exists within the store’s path resolution logic.

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score is not available, so the current likelihood of exploitation in the wild is unknown, but the lack of inclusion in CISA’s KEV catalog indicates no confirmed widespread exploitation. The attack vector is inferred to be local: an attacker must have low privileged local access to the machine, which is common in multi‑user environments or physical access scenarios. Once local access is achieved, the flaw can be exploited to elevate privileges and execute arbitrary code.