CVE-2026-52756— Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
Quick assessment
Affected
nationalsecurityagency ghidra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NSA Ghidra是美国国家安全局（National Security Agency）的一款开源逆向工程工具。 NSA Ghidra 12.2之前版本存在路径遍历漏洞，该漏洞源于IsfServer未验证客户端提供的命名空间字符串，导致远程攻击者通过路径遍历枚举文件系统路径。
Possible ATT&CK Techniques 2 AI
T1046 · Network Service Discovery T1083 · File and Directory DiscoveryAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nationalsecurityagency | ghidra | < 12.2 |
affected |
12.2 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-52756
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
Source: CVE Program / CVE List V5
Vulnerability Description
Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
NSA Ghidra 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NSA Ghidra是美国国家安全局（National Security Agency）的一款开源逆向工程工具。 NSA Ghidra 12.2之前版本存在路径遍历漏洞，该漏洞源于IsfServer未验证客户端提供的命名空间字符串，导致远程攻击者通过路径遍历枚举文件系统路径。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nationalsecurityagency | ghidra | 0 ~ 12.2 | - |
|
II. Public POCs for CVE-2026-52756
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-52756
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-52756 (2)
Same Patch Batch · nationalsecurityagency · 2026-06-10 · 14 CVEs total
| CVE-2026-52751 | 8.8 HIGH | Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project |
| CVE-2026-52758 | 8.8 HIGH | Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search |
| CVE-2026-52754 | 8.8 HIGH | Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule |
| CVE-2026-49498 | 8.8 HIGH | Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username |
| CVE-2026-52755 | 7.8 HIGH | Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import |
| CVE-2026-52750 | 7.8 HIGH | Ghidra < 12.1- Command Injection via URL Annotation Click |
| CVE-2026-52752 | 7.8 HIGH | Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names |
| CVE-2026-49496 | 6.1 MEDIUM | Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallo |
| CVE-2026-52753 | 5.5 MEDIUM | Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol |
| CVE-2026-49495 | 5.5 MEDIUM | Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser |
| CVE-2026-52757 | 4.4 MEDIUM | Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation |
| CVE-2026-49497 | 3.3 LOW | Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution |
| CVE-2024-58350 | 2.9 LOW | Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order |
IV. Related Vulnerabilities
Same product: ghidra
-
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via -
CVE-2026-18718
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via -
CVE-2026-52759
Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory -
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in -
CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge()
Same vendor: nationalsecurityagency
-
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via -
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in -
CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() -
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Impor -
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in
Same weakness: CWE-22
-
CVE-2026-32477
WordPress ShopBuilder Pro – Elementor WooCommerce Builder Ad -
CVE-2026-28171
WordPress WooCommerce File Approval plugin <= 10.7 - Arbitra -
CVE-2026-28167
WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Dow -
CVE-2026-66897
Instance template path traversal allows arbitrary host file -
CVE-2026-78196
achorein expo-share-intent Android File Copy Routine ExpoSha
V. Comments for CVE-2026-52756
No comments yet