CVE-2026-52755: Ghidra Path Traversal in Theme Import – HIGH Severity RCE Risk

Technical summary

CVE-2026-52755 is a path traversal vulnerability (CWE-22) in Ghidra versions prior to 12.0.4, affecting the theme import functionality. The vulnerability arises from insufficient validation of filenames within theme ZIP files during extraction. An attacker can embed path traversal sequences (e.g., '../../../') in archived filenames to cause files to be written outside the target theme directory. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector, no special privileges required, but user interaction needed; however, impact is high across confidentiality, integrity, and availability. The vulnerability enables arbitrary file write primitives, which can lead to arbitrary code execution through modification of executable startup files or credential theft via SSH key manipulation.

Business impact

The vulnerability poses a significant risk to security researchers, reverse engineers, and threat intelligence teams who rely on Ghidra daily. A compromised workstation running an outdated Ghidra version could allow an attacker to establish persistent access, exfiltrate source code or analysis work, or pivot to broader network compromise. Organizations using Ghidra in air-gapped or sensitive environments face elevated risk if users are socially engineered into importing malicious themes. The attack surface is non-trivial because it requires user interaction, but motivated attackers can integrate malicious themes into forums, threat intelligence feeds, or supply-chain distribution points targeting the reverse-engineering community.

Affected systems

Ghidra versions before 12.0.4 are affected. This includes all publicly released versions up to and including 12.0.3. The vulnerability is specific to the NSA's Ghidra distribution; custom builds or forks may have different patching status. Users on Linux, macOS, and Windows are all potentially affected if they use a vulnerable version and import untrusted theme files.

Exploitability

Exploitability is moderate to high in targeted scenarios. The vulnerability requires user interaction—specifically, the user must import a malicious theme file into Ghidra. There are no special privileges or authentication barriers. Attack distribution could leverage social engineering (e.g., "Download this community theme to improve your workflow") or compromise of theme repositories. Once a malicious theme is imported, the file write occurs automatically, making detection and mitigation by the end user difficult without deep technical knowledge. No public exploit code or active exploitation in the wild has been reported as of the advisory date.

Remediation

Upgrade Ghidra to version 12.0.4 or later immediately. There is no workaround for versions below 12.0.4 other than avoiding import of themes from untrusted sources. After patching, review system logs and file access patterns on machines that may have imported untrusted themes prior to the patch, particularly watching for suspicious modifications to ~/.bashrc, ~/.ssh/authorized_keys, shell profiles, or other startup files that could indicate previous exploitation.

Patch guidance

Download and install Ghidra 12.0.4 or later from the official NSA GitHub repository (https://github.com/NationalSecurityAgency/ghidra/releases). Verify the release signature and checksums to ensure authenticity. Organizations should test the patch in a non-production environment first, especially those with custom Ghidra configurations or plugins. Update package manager entries (if using Homebrew, apt, or other distribution channels) to ensure automated updates pull the patched version. Consider setting update policies to require Ghidra updates within a defined window (e.g., 2 weeks for HIGH severity).

Detection guidance

Monitor for suspicious file modifications in user home directories, particularly in ~/.bashrc, ~/.bash_profile, ~/.ssh/, or other startup/credential storage locations during or shortly after Ghidra theme imports. File integrity monitoring tools or endpoint detection and response (EDR) solutions can flag unexpected writes outside theme directories. Review Ghidra process logs and operating system audit logs (auditd on Linux, File Auditing on Windows) for theme import operations followed by file writes to unexpected paths. Hunt for ZIP extraction activity by Ghidra followed by write syscalls to paths containing '../' or similar traversal sequences in the original filename. Check for persistence indicators (newly added cron jobs, SSH public keys, shell profile modifications) on systems where theme imports occurred.

Why prioritize this

This vulnerability merits immediate patching despite moderate exploitability because: (1) the impact is high—arbitrary file write enables code execution and persistent access; (2) Ghidra is used extensively by security teams and threat intelligence units, making them targets for supply-chain or social engineering attacks; (3) the user interaction barrier is low in targeted scenarios where themes are distributed through community channels; (4) previously compromised systems may show subtle signs of tampering with startup files or SSH keys that are hard to detect without forensic analysis. Organizations should prioritize patching critical/tier-1 research and analyst workstations first.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) correctly reflects a local vulnerability with no privilege escalation needed but requiring user interaction. The vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates: Local Attack Vector (Ghidra runs locally); Low Attack Complexity (path traversal is straightforward to exploit); No Privileges required; User Interaction required (theme import); Unchanged Scope; and High impact on all three CIA pillars. In real-world risk modeling, this should be treated as slightly more urgent than the score suggests because the attack surface (security researcher population) is high-value and concentrated, and because file-write primitives are proximate to code execution in most desktop environments.

Frequently asked questions