PT-2026-48416

CVE-2026-52756

Published

2026-06-10

Updated

2026-06-12

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.2

Description The IsfServer accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation, leading to an unauthenticated path traversal. Remote attackers can connect to port '54321' and send crafted protobuf messages containing traversal sequences to enumerate filesystem paths and probe arbitrary files.

Recommendations Update to version 12.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sean Nejad

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers