{"id":"CVE-2026-52756","summary":"Ghidra \u003c 12.2 - Unauthenticated Path Traversal in Debugger ISF Server","details":"Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.","aliases":["GHSA-8pr2-46mf-v2r2"],"modified":"2026-10-30T07:04:18.218530535Z","published":"2026-06-10T12:41:39.456Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52756.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52756.json"},{"type":"ADVISORY","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52756"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ghidra-unauthenticated-path-traversal-in-debugger-isf-server"},{"type":"PACKAGE","url":"https://github.com/nationalsecurityagency/ghidra"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nationalsecurityagency/ghidra","events":[{"introduced":"0"},{"fixed":"8ca9077040cc43cd790babcfccf19475622a3e9a"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"12.2"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0"},{"last_affected":"12.1.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*"}]}}],"versions":["Ghidra_10.3_build","Ghidra_9.0.1_build"],"database_specific":{"vanir_signatures":[{"target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java","function":"certificate"},"deprecated":false,"digest":{"function_hash":"35098355418340090819445447453425725897","length":717},"id":"CVE-2026-52756-0fec66f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a"},{"deprecated":false,"digest":{"function_hash":"79399721206663996822832979141586592611","length":547},"id":"CVE-2026-52756-65cfe3dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java","function":"testPkcs7BundleImport"}},{"signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java"},"deprecated":false,"digest":{"line_hashes":["222320940127169493782474282906290125102","72321773847227983407854271332936824527","144263013747034095107671374771825431109","336710527929783468757395210034319121124","142753109097189343564835199937859397392","187344603634577604895047994945375055658","4174189892957150070366995802546801593","312611606870255653314630899857206963846","97104238693422362815718223128782080133","337830716104768838951474364905170692087","109167190863602539280575897841095808674","64976650795033076015800729666197899899","332501394050701359083821295211266668604","182723386859815934083467161070328267328","163154494892193754618108421439207695741","88788387854193108843284841798664976168","228169540734090152261365618807293194765","230924198397012789617565327762625346531","85158868899266919115300447099787036898","148767883359069035844320795782810961528","128219341942996200327377299977180306503","116626003279469684309346633306864482107","188929165070388368464013510618646141322","312665971007993141762279861656209212573","230520458133359003813473499280091094757","150998969676802715593372749813568996850","241220000070131354957597456263461987996","141289340489876393225356149509527552600","230946087034084260041784442443878998996","171471411624852656114406395169514586091","12025612366875099026064142778464790581","196014976694521124551978951949667328289","202462418482135599451808625265026894660","60895330027268918575142105276355823859","240665342723158339730210555128503524985","334417461194141587763406497791141342910","133162135177699193987450594681309870498","60087459296783992434105258416426696088","310184437524515907561505200868137571040","137888225798075235875134167018901270653","300153688203137417898517837426474823656","305008590166855026378258567246405677785","124941650120139932834834717226965388603","161149148153736269638940970117039773758","190775470446340535734127164844626497654","90687336446837434255635954440659005491","114780722558269978480534210026419678728","308945042841025282660213057632200924277","70788933646603794255729784261373609769","35795367723879710511876090792693717327"],"threshold":0.9},"id":"CVE-2026-52756-8a92a401","signature_type":"Line"},{"digest":{"line_hashes":["52260170192409646835285165401292709034","103971869609780822122085536082128779846","142898632721031646331993354072277700181","35551601623176545098590158866828933717","245409069975075909621496081723036693811","33921928000463531414537185765144460828","264179150465973511510176668117680361619","113372360150607665446348141516281879265","151958410683971495153535280478436364632","319423640246836754933700380065232343427","9941090939463034869389725621245527354","19804950111014302674687943968085813747","293305186831221734129230444977873527895"],"threshold":0.9},"id":"CVE-2026-52756-9bb4e6db","signature_type":"Line","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/PKITestUtils.java"},"deprecated":false}],"vanir_signatures_modified":"2026-10-30T07:04:18Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52756.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"}]}