EUVD-2026-45968Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs org membership to create a workspace (PR:L) but no victim interaction (UI:N); NTLM disclosure and client hang give C:H/A:H, while integrity impact is only indirect (I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt \ char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [NTLM] hash.
AnalysisAI
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Technical ContextAI
Parsec is a cryptographically secure, cloud-based file-sharing application; on Windows it exposes each organization workspace as a filesystem mountpoint. The flaw is a Windows UNC share path injection (CWE-40, 'Path Traversal: \\UNC\share\name\'): because the backslash character is permitted in workspace names and the name is used verbatim when constructing the mountpoint, a name such as \\host\share is interpreted by the Windows filesystem/SMB stack as a remote UNC target rather than a local label. When Windows resolves that UNC path it automatically initiates an SMB/NTLM authentication handshake to the specified host, which is the classic vector for coercing a machine to disclose its NetNTLMv1/v2 challenge-response (the 'NTLM hash' referenced in the advisory). The affected component is cpe:2.3:a:scille:parsec-cloud, and the trigger is entirely within the workspace-naming feature.
RemediationAI
Vendor-released patch: upgrade parsec-cloud to 3.3.3-rc.0 or later, which sanitizes workspace names before they are used to build Windows mountpoints; consult the vendor advisory GHSA-qx56-wxpm-j4m6 (https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6) for the released version. Where immediate patching is not possible, compensating controls include administratively vetting/blocking workspace names that contain backslash characters or UNC-like prefixes (\\), and restricting who may create or rename workspaces to trusted administrators to reduce the pool of potential attackers. At the network layer, block outbound SMB (TCP 445 and legacy 137-139) from Parsec client hosts to untrusted destinations so coerced UNC connections cannot reach an attacker's server, and enforce SMB signing and disable NTLM where feasible; the trade-off is that outbound-SMB blocking may break legitimate file-share access and NTLM hardening can disrupt other Windows integrations, so test before rollout.
More in Parsec Cloud
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today