PT-2026-48416 · Ghidra · Ghidra

Sean Nejad · CVE-2026-52756 · Published 2026-06-10 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.2

Description The IsfServer accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation, leading to an unauthenticated path traversal. Remote attackers can connect to port '54321' and send crafted protobuf messages containing traversal sequences to enumerate filesystem paths and probe arbitrary files.

Recommendations Update to version 12.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-52756

GHSA-8PR2-46MF-V2R2

Affected Products

Ghidra

References · 9

• 🔥 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52756.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-52756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52756 · Security Note
• https://github.com/nationalsecurityagency/ghidra · Note
• https://t.me/cveNotify/167155 · Telegram Post
• https://twitter.com/CVEnew/status/2064709808209490304 · Twitter Post
• https://vulncheck.com/advisories/ghidra-unauthenticated-path-traversal-in-debugger-isf-server · Note
• https://t.me/CVEtracker/56450 · Telegram Post