Executive brief
SolidCAM-GPPL-IDE is a development tool used to create and edit postprocessor files for SolidCAM software. A security flaw allows a malicious file to automatically probe the user's computer for the existence of specific files and leak the user's network login credentials (NTLM hashes) to an attacker's server. This occurs simply by opening a specially crafted file, potentially leading to unauthorized access to the user's account or internal corporate network.
Technical details
The GpplDocumentLinkHandler in the SolidCAM-GPPL-IDE extension fails to properly sanitize paths within the 'inc' directive. It accepts absolute paths, parent-directory segments (..\), and UNC paths, passing them directly to File.Exists to determine if a clickable link should be rendered in the IDE. This creates two primary vulnerabilities: first, a path traversal flaw (CWE-22) that allows an attacker to probe for the existence of sensitive files on the local system; second, a credential leak where a UNC path triggers an automatic SMB authentication attempt, sending the victim's NTLMv2 hash to an attacker-controlled server. Exploitation occurs upon opening a malicious .gpp file without requiring the user to click any links. The issue is fixed in version 1.0.2 by restricting 'inc' directives to simple filenames within the same directory.
Affected products
- anzory SolidCAM-GPPL-IDE (VS Code Extension) 1.0.0 to 1.0.1
Timeline
- 2026-04-20: patched: Version 1.0.2 released with security hotfix
- 2026-04-20: advisory: GitHub Security Advisory GHSA-xvpx-9p39-g62m published
- 2026-05-08: disclosed: CVE-2026-42213 published to NVD