CVE-2026-42213

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42213

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42213.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42213

Aliases

GHSA-xvpx-9p39-g62m

Published

2026-05-08T21:38:40.860Z

Modified

2026-07-08T08:13:14.567839917Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak

Details

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive in GPPL postprocessor files is resolved by GpplDocumentLinkHandler into a clickable link (VS Code textDocument/documentLink). The handler accepted arbitrary paths — absolute, relative with parent-directory segments (......), UNC (\server\share), and arbitrary subfolders — and called File.Exists on each to decide whether to render the link. Two distinct attack surfaces resulted: information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. This issue has been patched in version 1.0.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42213.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-22",
        "CWE-295",
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/anzory/solidcam-gppl-ide

Affected ranges

Type

GIT

Repo

https://github.com/anzory/solidcam-gppl-ide

Events

Introduced

d1944bca6e984665fb98f5ea824c6c370fd618d6

Fixed

9d0ba808afd143ede448026a5dc681bfdc5c138d

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.0.2"
        },
        {
            "introduced": "0"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42213.json"