# CVE-2026-52756: NSA Ghidra path traversal in Debugger IsfServer

Source: https://junglewise.ai/threats/cve-2026-52756-nsa-ghidra-path-traversal-in-debugger-isfserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-52756 · Severity: medium · CVSS 4.8 · Published 2026-06-10

Ghidra, a popular software reverse engineering suite, contains a security flaw in an experimental debugging component. If a user manually starts this specific server component, an attacker on the network can remotely probe the computer's files and folders without needing a password. This could allow an unauthorized person to map out the system's file structure or cause the application to crash.

Technologies: [National Security Agency Ghidra](https://junglewise.ai/threats/technologies/ghidra). Vendors: [National Security Agency](https://junglewise.ai/threats/vendors/national-security-agency).

## Quick answers

**Is CVE-2026-52756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52756 being exploited in the wild.

**How severe is CVE-2026-52756?** Medium severity, with a CVSS score of 4.8, published 10 June 2026.

**Which products and versions are affected?** National Security Agency Ghidra < 12.2.

**Is there a fix for CVE-2026-52756?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52756 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52756?** Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the IsfServer component of Ghidra (specifically within the Debugger-isf module) due to improper validation of client-supplied strings. The server listens on TCP port 54321 and processes 'namespace' (ns) fields from protobuf messages directly into java.io.File operations without sanitization. An unauthenticated remote attacker can send crafted messages containing traversal sequences (e.g., '../') to probe for the existence of arbitrary files or directories. While full file content reading is limited to valid Ghidra archives, differential error responses allow for filesystem enumeration, and attempting to open large files can lead to a denial of service. This vulnerability is patched in Ghidra version 12.2.

## Affected products

- NSA Ghidra < 12.2

## Timeline

- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication and CVE assignment

## References

- [https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2](https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2)
- [https://www.vulncheck.com/advisories/ghidra-unauthenticated-path-traversal-in-debugger-isf-server](https://www.vulncheck.com/advisories/ghidra-unauthenticated-path-traversal-in-debugger-isf-server)

## Related threats

- [Ghidra zip bomb in extension extraction](https://junglewise.ai/threats/cve-2026-115503-ghidra-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource allocation without limits in extension extraction](https://junglewise.ai/threats/cve-2026-115397-ghidra-before-12-2-contains-a-resource-allocation-without-limits)
- [Ghidra zip bomb vulnerability in theme import](https://junglewise.ai/threats/cve-2026-115396-ghidra-10-3-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource exhaustion in theme ZIP extraction](https://junglewise.ai/threats/cve-2026-115395-ghidra-10-3-before-12-2-contains-a-resource-allocation-without)
- [National Security Agency Ghidra heap out-of-bounds read in StringManager](https://junglewise.ai/threats/cve-2026-100505-ghidra-versions-11-2-through-12-1-4-contain-a-heap-out-of-bounds)