UNC path traversal in Parsec Cloud workspace mountpoint (CVE-2026-25039)

Parsec Cloud does not sanitize workspace names before using them to create mountpoints on the Windows filesystem, allowing a workspace name containing a UNC path (e.g. `\\192.168.1.3\test`) to be evaluated as a network path. An attacker with low privileges can create a maliciously named workspace, share it with targeted users, and upon automatic mounting intercept NTLM credential hashes or render the application unresponsive. Affected versions: - parsec-cloud (application) < 3.3.3-rc.0 We recommend updating to: 3.3.3-rc.0. CVSS 8.8 · our assessment: this_week Reference: https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 Details: https://vuln.today/cve/CVE-2026-25039