Unauthenticated Path Traversal Vulnerability in Ghidra by National Security Agency
CVE-2026-52756

6.3MEDIUM

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
10 June 2026

What is CVE-2026-52756?

Ghidra, prior to version 12.2, is susceptible to an unauthenticated path traversal vulnerability within the IsfServer component. This flaw allows remote attackers to exploit the TCP service on port 54321 by sending specially crafted protobuf messages containing path traversal sequences. The vulnerability exists because client-supplied namespace strings are processed without adequate validation during file system operations. As a result, attackers can potentially enumerate filesystem paths and access arbitrary files, posing a significant risk to system integrity.

Affected Version(s)

ghidra 0 < 12.2

ghidra 12.2

References

https://github.com/NationalSecurityAgency/ghidra/security...
vendor-advisory
https://www.vulncheck.com/advisories/ghidra-unauthenticat...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sean Nejad (@allsmog)
.