CVE-2026-52755: Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorizedkeys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.0.4 - Operational
Inspect systems where Ghidra was used to import themes for unauthorized files or modifications. In particular, look for files written outside the theme directory and check user startup and SSH authorization files (e.g., .bashrc, .ssh/authorized_keys) for malicious additions; remove or restore any malicious or unexpected changes and investigate for possible arbitrary code execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52755?
CVE-2026-52755 has a severity rating of 8.4, classified as high.
How do I fix CVE-2026-52755?
To fix CVE-2026-52755, update Ghidra to version 12.0.4 or later.
What type of vulnerability is CVE-2026-52755?
CVE-2026-52755 is a path traversal vulnerability.
What impact does CVE-2026-52755 have?
CVE-2026-52755 allows attackers to write files outside the intended theme directory, potentially executing arbitrary code.
How can attackers exploit CVE-2026-52755?
Attackers exploit CVE-2026-52755 by crafting malicious theme ZIP files with traversal sequences in filenames.