Executive brief
Scille Parsec, a cloud-based secure file sharing application, contains a vulnerability where it fails to properly validate workspace names. An attacker can create a workspace with a specially crafted name that points to a malicious network location. When other users in the organization access this workspace, their systems may automatically attempt to connect to the attacker's server, potentially leaking sensitive login credentials (NTLM hashes) or causing the application to freeze.
Technical details
A path traversal vulnerability exists in Scille Parsec due to insufficient sanitization of workspace names when creating Windows mountpoints. The application allows the backslash character in workspace names, which can be used to define a Windows Universal Naming Convention (UNC) path. When the application attempts to mount a workspace named with a UNC path (e.g., \\attacker-ip\share), the Windows operating system initiates a connection to the remote resource. This allows a remote attacker with low privileges to capture NTLM authentication hashes from targeted users or cause a denial-of-service (unresponsiveness) if the UNC path is unreachable. The issue is addressed in version 3.3.3-rc.0.
Affected products
- Scille parsec-cloud < 3.3.3-rc.0
- Scille libparsec_mountpoint < 3.3.3-rc.0
Timeline
- 2026-06-30: advisory: GitHub advisory published by maintainer
- 2026-07-20: disclosed: NVD publication date
- 2026-07-20: patched: Version 3.3.3-rc.0 released