CVE-2026-52756

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52756
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52756.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52756
Aliases
  • GHSA-8pr2-46mf-v2r2
Published
2026-06-10T12:41:39.456Z
Modified
2026-07-08T08:14:02.754927503Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
Details

Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52756.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "12.2"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "fixed": "12.2"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "12.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/nationalsecurityagency/ghidra

Affected ranges

Type
GIT
Repo
https://github.com/nationalsecurityagency/ghidra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c0f584bf229fffba61b36431f3ce30c0c3e4e682
Database specific 
{
    "cpe": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "12.1.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Ghidra_10.*
Ghidra_10.3_build
Ghidra_12.*
Ghidra_12.1.1_build
Ghidra_12.1.2_build
Ghidra_12.1_build
Ghidra_9.*
Ghidra_9.0.1_build

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52756.json"