CVE-2026-25039 Details
Description
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.
A vulnerability exists in Parsec Cloud versions prior to 3.3.3-rc.0 due to improper sanitization of workspace names. This flaw allows workspace names to include backslashes, potentially creating a Universal Naming Convention (UNC) path. When such a path is mounted in the Windows filesystem, the application may become unresponsive if the path is invalid. However, if the path is valid, the system will interact with the resource, enabling an attacker to capture NTLM authentication hashes.
Users can update to Parsec Cloud version 3.3.3-rc.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Scille Parsec | < 3.3.3-rc.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |