PT-2026-39201 · Unknown · Solidcam-Gppl-Ide

Claude Opus · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42213

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SolidCAM-GPPL-IDE versions 1.0.0 through 1.0.1

Description The GpplDocumentLinkHandler resolves the filename directive in GPPL postprocessor files into clickable links. The handler accepts arbitrary absolute, relative, UNC, and subfolder paths, calling File.Exists to determine if a link should be rendered. This allows for information disclosure through path probing and NTLM hash leaks via UNC path probing.

Recommendations Update to version 1.0.2.

Exploit

Fix

Information Disclosure

SSRF

Path traversal

Improper Certificate Validation

Weakness Enumeration

CWE-200

CWE-918

CWE-22

CWE-295

Related Identifiers

CVE-2026-42213

Affected Products

Solidcam-Gppl-Ide

References · 6

• 🔥 https://github.com/anzory/SolidCAM-GPPL-IDE/security/advisories/GHSA-xvpx-9p39-g62m · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42213 · Security Note
• https://github.com/anzory/SolidCAM-GPPL-IDE/commit/9d0ba808afd143ede448026a5dc681bfdc5c138d · Note
• https://github.com/anzory/SolidCAM-GPPL-IDE/releases/tag/v1.0.2 · Note
• https://twitter.com/CVEnew/status/2053131435893207395 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052978272552501584 · Twitter Post