CVE-2026-52752: Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-10 · updated 2026-10-26
Weakness: CWE-22

Description

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

Affected products

nationalsecurityagency ghidra: before 12.0.2 — fixed in 12.0.2

How to fix

Upgrade to a fixed version: nationalsecurityagency ghidra 12.0.2. Check the vendor advisory for mitigations.

References

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-jhc2-q7qf-9c25
https://www.vulncheck.com/advisories/ghidra-path-traversal-in-extension-installer-via-zip-entry-names
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-jhc2-q7qf-9c25

Get alerted when CVE-2026-52752 or the next vulnerability affects your stack