CVE-2026-42213

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive in GPPL postprocessor files is resolved by GpplDocumentLinkHandler into a clickable link (VS Code textDocument/documentLink). The handler accepted arbitrary paths — absolute, relative with parent-directory segments (..\..\..\), UNC (\\server\share\), and arbitrary subfolders — and called File.Exists on each to decide whether to render the link. Two distinct attack surfaces resulted: information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. This issue has been patched in version 1.0.2.

• CWE-22
• CWE-200
• CWE-295
• CWE-918

• https://github.com/anzory/SolidCAM-GPPL-IDE/commit/9d0ba808afd143ede448026a5dc681bfdc5c138d
• https://github.com/anzory/SolidCAM-GPPL-IDE/releases/tag/v1.0.2
• https://github.com/anzory/SolidCAM-GPPL-IDE/security/advisories/GHSA-xvpx-9p39-g62m
• https://github.com/anzory/SolidCAM-GPPL-IDE/security/advisories/GHSA-xvpx-9p39-g62m

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42208LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.8
• CVE-2026-42209FlashMQ is a MQTT broker/server, designed for multi-CPU envi…6.5
• CVE-2026-4221A vulnerability was found in Tiandy Easy7 Integrated Managem…7.3
• CVE-2026-42210Webmin is a web-based system administration tool for Unix-li…5.3
• CVE-2026-42211React Router is a router for React. In versions 7.0.0 throug…8.1
• CVE-2026-42212SolidCAM-GPPL-IDE is an unofficial, independently developed …7.1
• CVE-2026-42214Notepad Next is a cross-platform, reimplementation of Notepa…7.8
• CVE-2026-42215GitPython is a python library used to interact with Git repo…8.8
• CVE-2026-42216OpenEXR provides the specification and reference implementat…9.1
• CVE-2026-42217OpenEXR provides the specification and reference implementat…9.8
• CVE-2026-42218xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
• CVE-2026-42219Frappe is a full-stack web application framework. Prior to 1…6.9