Executive brief
Ghidra, a popular software reverse engineering suite, contains a security flaw in an experimental debugging component. If a user manually starts this specific server component, an attacker on the network can remotely probe the computer's files and folders without needing a password. This could allow an unauthorized person to map out the system's file structure or cause the application to crash.
Technical details
A path traversal vulnerability exists in the IsfServer component of Ghidra (specifically within the Debugger-isf module) due to improper validation of client-supplied strings. The server listens on TCP port 54321 and processes 'namespace' (ns) fields from protobuf messages directly into java.io.File operations without sanitization. An unauthenticated remote attacker can send crafted messages containing traversal sequences (e.g., '../') to probe for the existence of arbitrary files or directories. While full file content reading is limited to valid Ghidra archives, differential error responses allow for filesystem enumeration, and attempting to open large files can lead to a denial of service. This vulnerability is patched in Ghidra version 12.2.
Affected products
- NSA Ghidra < 12.2
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication and CVE assignment