PT-2026-48412 · Ghidra · Ghidra

Prasanthsundararajan69 · CVE-2026-52752 · Published 2026-06-10 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.0.2

Description The extension installer fails to validate ZIP entry names during extraction. This allows attackers to use traversal sequences, such as ../ in filenames, to write arbitrary files outside the intended directory, which can lead to code execution.

Recommendations Update to version 12.0.2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-52752

GHSA-JHC2-Q7QF-9C25

Affected Products

Ghidra

References · 8

• 🔥 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-jhc2-q7qf-9c25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52752.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-52752 · Security Note
• https://osv.dev/vulnerability/CVE-2026-52752 · Vendor Advisory
• https://github.com/nationalsecurityagency/ghidra · Note
• https://vulncheck.com/advisories/ghidra-path-traversal-in-extension-installer-via-zip-entry-names · Note
• https://t.me/CVEtracker/56446 · Telegram Post
• https://twitter.com/CVEnew/status/2064709814299594808 · Twitter Post