The vulnerability in SolidCAM-GPPL-IDE versions >=1.0.0 and <1.0.2 involves the inc "filename" directive in GPPL postprocessor files, which is resolved by GpplDocumentLinkHandler into clickable links. The handler accepted arbitrary file paths, including those with directory traversal sequences and UNC paths, and used File.Exists to check their existence. This improper limitation of pathname allows attackers to probe the file system for information disclosure and potentially leak NTLM hashes via UNC path probing. The vendor patched this issue in version 1.0.2.

Exploitation of this vulnerability can lead to information disclosure by allowing an attacker to probe the existence of files on the victim's system. Additionally, the use of UNC path probing can result in NTLM hash leakage, which could be used in further attacks such as relay or credential theft. The CVSS score of 5.1 reflects a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.

This vulnerability has been patched in SolidCAM-GPPL-IDE version 1.0.2. Users and administrators should upgrade to version 1.0.2 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.