Back to overview

CVE-2026-25039

HIGH Exploitation: PoC
8.8
CVSS 3.1
Description
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.

Metadata

CVE ID
CVE-2026-25039
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-01-28 14:50 UTC
Published
2026-07-20 14:53 UTC
Last updated
2026-07-20 16:29 UTC
Primary CWE
CWE-40
CWE-40: Path Traversal: 'UNCsharename' (Windows UNC Share)
Vendor / Product
Scille / parsec-cloud
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Scille parsec-cloud — < 3.3.3-rc.0
Weakness (CWE)
CWESourceDescription
CWE-40 cna CWE-40: Path Traversal: 'UNCsharename' (Windows UNC Share)
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview