Vulnerability in Parsec Application Allows UNC Path Exploitation

CVE-2026-25039

What is CVE-2026-25039?

The Parsec application, a cloud-based solution for secure file sharing, contains a vulnerability related to improper input validation of workspace names. When users create a workspace with a name that includes a '' character, the application can potentially evaluate this as a UNC path. If the specified UNC path is invalid, the application may become unresponsive. Conversely, if the path is valid, it allows interaction with the UNC path, granting the attacker the possibility to retrieve NTLM hashes, which could compromise user credentials. Proper validation and sanitization of the workspace name input are crucial to mitigating this issue.

References