The parsec‑cloud application does not sanitize workspace names that contain backslashes. When a workspace name resolves to a UNC path, the client creates a mount point in the Windows file system. Because the name is not validated, an attacker that supplies a malicious UNC path may cause the client to mount a target's shared directory and read NTLM hash credentials, or, if the target is unreachable, cause the client to become unresponsive. This weakness is consistent with CWE‑40, which is a path traversal/command injection type issue.

The affected product is Scille’s parsec‑cloud, a cloud‑based file sharing service. No explicit version numbers are listed for the fix or the vulnerability, so any deployment that has not applied the patch is potentially vulnerable.

The CVSS base score is 8.8, indicating a high‑severity vulnerability. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can create or modify workspace names can deliver a crafted UNC path; if the path points to a valid SMB share, the client may mount the resource and read NTLM hash credentials from the target machine. If the path is invalid, the client becomes unresponsive, which could be used for a denial‑of‑service attack.