Scille parsec-cloud up to 3.3.2 Mountpoint workspace_name input validation

Summaryinfo

A vulnerability identified as critical has been detected in Scille parsec-cloud up to 3.3.2. Impacted is an unknown function of the component Mountpoint. The manipulation of the argument workspace_name leads to input validation. This vulnerability is uniquely identified as CVE-2026-25039. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Scille parsec-cloud up to 3.3.2. It has been rated as critical. This issue affects some unknown functionality of the component Mountpoint. The manipulation of the argument workspace_name with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-25039 since 01/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.3.3-rc.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Scille

Name

• parsec-cloud

Version

• 3.3.0
• 3.3.1
• 3.3.2

Website

• Product: https://github.com/Scille/parsec-cloud/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion