SolidCAM‑GPPL‑IDE opens a companion .vmid file whenever a .gpp file is loaded. The parser uses XDocument.Load without any XmlReaderSettings, which in .NET 8 defaults to allowing external DTD processing. Consequently an attacker can embed entity references that resolve to local file paths, causing the application to read arbitrary files from the user’s machine. The parser can also be fed recursive or deeply nested entities, resulting in excessive memory consumption or crashes, thereby causing denial of service. The weakness is a classic XML External Entity attack (CWE‑611) coupled with a denial‑of‑service condition (CWE‑400) and restricted access control for the file system (CWE‑776).

The issue applies to Anzory’s SolidCAM‑GPPL‑IDE extension for SolidCAM, affecting all releases from 1.0.0 up to, but not including, 1.0.2. Version 1.0.2 and later include a fix that sanitizes the XML input.

The CVSS score of 7.1 indicates a moderate to high risk for exposed systems. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Based on the description, the likely attack vector is local file supply: an adversary must place a malicious .vmid file beside a .gpp file in the same directory and entice the user to open the .gpp file, which triggers the parser. Once the file is processed, disclosure or denial of service can occur. The vulnerability remains active until the patched version is deployed.