PT-2026-48412

CVE-2026-52752

Published

2026-06-10

Updated

2026-06-10

Description by

CVSS 4.0

8.4

High

MetricsAV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.0.2

Description The extension installer fails to validate ZIP entry names during extraction. This allows attackers to use traversal sequences, such as ../ in filenames, to write arbitrary files outside the intended directory, which can lead to code execution.

Recommendations Update to version 12.0.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Prasanthsundararajan69

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers