Medium severity · published Jun 10, 2026
CVE-2026-52756
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GH
ghidra · nationalsecurityagency
before 12.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52756
Exploit
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2
Third Party Advisory
https://www.vulncheck.com/advisories/ghidra-unauthenticated-path-traversal-in-debugger-isf-server
More from ghidra
8.8
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
8.8
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
8.8
CVE-2026-52751
Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
8.8
CVE-2026-49498
Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
7.8
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import