Executive brief
Ghidra is a software reverse engineering suite used by security researchers to analyze code. A vulnerability in its extension installer allows a malicious extension to write files to sensitive locations on a user's computer. If a user is tricked into installing a specially crafted extension, an attacker could gain full control over the system by overwriting critical startup files or scripts.
Technical details
A path traversal vulnerability (Zip Slip) exists in Ghidra's ExtensionUtils.java. The extension installer fails to validate ZIP entry names during extraction, allowing entries containing '../' sequences to resolve to locations outside the intended installation directory. An attacker can exploit this by providing a malicious extension ZIP that, when installed via the 'File -> Install Extensions' menu, writes arbitrary files to the filesystem. This can be leveraged for remote code execution by overwriting user configuration files like .bashrc or SSH keys. The issue is fixed in version 12.0.2 by implementing path validation using FileUtilities.isPathContainedWithin().
Affected products
- NSA Ghidra < 12.0.2
Timeline
- 2026-02-02: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date