EUVD-2026-28840Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack delivered via network-sourced file requiring user open action (UI:R); no authentication needed; confidentiality impact low, limited to file existence disclosure and NTLM hash exposure with no integrity or availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive in GPPL postprocessor files is resolved by GpplDocumentLinkHandler into a clickable link (VS Code textDocument/documentLink). The handler accepted arbitrary paths - absolute, relative with parent-directory segments (..\..\..\), UNC (\\server\share\), and arbitrary subfolders - and called File.Exists on each to decide whether to render the link. Two distinct attack surfaces resulted: information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. This issue has been patched in version 1.0.2.
AnalysisAI
Path traversal in SolidCAM-GPPL-IDE versions 1.0.0 through 1.0.1 allows an attacker to deliver a malicious GPPL postprocessor file that, when opened in VS Code, probes the victim's filesystem for file existence and leaks Windows NTLM credentials to an attacker-controlled SMB server. The extension's GpplDocumentLinkHandler resolved inc directive paths - including parent-directory traversal sequences (..\..\..) and UNC shares (\\server\share) - through unsanitized File.Exists calls, creating two distinct information disclosure vectors. Publicly available exploit code exists per SSVC classification; exploitation probability is very low (EPSS 0.05%), and the vulnerability is patched in version 1.0.2 released 2026-04-20.
Technical ContextAI
SolidCAM-GPPL-IDE is an unofficial VS Code language server extension implementing an IDE for GPPL (General Purpose Postprocessor Language), a scripting format used to configure SolidCAM CAM software's postprocessors. The GPPL format supports an inc "filename" directive for file inclusion; GpplDocumentLinkHandler resolved these directives into VS Code textDocument/documentLink clickable links by calling File.Exists on the extracted path. The handler performed no canonicalization or directory restriction, accepting absolute paths, relative paths with parent-directory segments (..), UNC paths (\\server\share\), and arbitrary subfolder references. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause: the resolved path was never checked to remain within the host document's containing directory. The UNC vector is particularly sensitive because Windows' SMB client automatically initiates NTLM authentication when File.Exists is called on a UNC path, sending the user's credential hash to whatever host the UNC points to. The commit diff (9d0ba808) confirms the fix now enforces basename-only resolution, rejecting all path separators, parent-directory segments, UNC prefixes, drive-letter prefixes, and characters in Path.GetInvalidFileNameChars(), with a post-resolution canonical check confirming the final path remains inside the host directory.
RemediationAI
Upgrade SolidCAM-GPPL-IDE to version 1.0.2 or later, available at https://github.com/anzory/SolidCAM-GPPL-IDE/releases/tag/v1.0.2; this is the vendor-confirmed patched release. The fix in commit 9d0ba808 restricts inc directive resolution to plain basenames co-located with the host file, eliminating the traversal and UNC attack surfaces without affecting compliant GPPL files. As an immediate compensating control before patching, block outbound SMB traffic on TCP/445 and TCP/139 at the host or perimeter firewall - this neutralizes the NTLM hash leak vector but does not prevent filesystem existence probing. Disabling or uninstalling the extension when not actively developing postprocessors removes the attack surface entirely and carries no side effects for non-development use. Avoid opening .gpp files received from untrusted sources, shared repositories, or email attachments regardless of patch status, as the social-engineering vector is the primary delivery mechanism.
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today