CVE-2026-52755: NSA Ghidra path traversal in theme import

CVE-2026-52755 · Severity: high · CVSS 7.8 · Published 2026-06-10

Ghidra, a popular software reverse-engineering suite, is vulnerable to a security flaw in its theme import feature. An attacker can trick a user into importing a specially crafted theme file that silently writes malicious files to the user's computer. This could allow an attacker to gain full control of the system or steal sensitive data by overwriting critical configuration files.

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Quick answers

Is CVE-2026-52755 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52755 being exploited in the wild.
How severe is CVE-2026-52755?
High severity, with a CVSS score of 7.8, published 10 June 2026.
Which products and versions are affected?
National Security Agency Ghidra < 12.0.4.
Is there a fix for CVE-2026-52755?
A patch was published on 2026-06-10: Fix released in version 12.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52755 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-52755?
Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (Zip Slip) exists in Ghidra's theme import logic within 'ThemeUtils.java'. When a user imports a ZIP-based theme via the GUI, the application fails to validate that the entry names within the ZIP file do not contain traversal sequences (e.g., '../'). An attacker can craft a malicious ZIP file that, when imported, writes files to arbitrary locations on the filesystem where the user has write permissions. This can be leveraged for remote code execution by overwriting sensitive files such as '.bashrc' or adding keys to '.ssh/authorized_keys'. The vulnerability is addressed in version 12.0.4 by implementing path validation using 'FileUtilities.isPathContainedWithin()'.

Affected products

  • NSA Ghidra < 12.0.4

Timeline

  • 2026-03-10: advisory: Initial GitHub Security Advisory published
  • 2026-06-10: disclosed: CVE published and NVD record created
  • 2026-06-10: patched: Fix released in version 12.0.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.