CVE-2026-52756: Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ghidrato a version that resolves this vulnerability.Fixed in 12.2 - Configuration
Disable the debugger IsfServer (the component that accepts TCP connections on port 54321) if it is not required to prevent unauthenticated path traversal attempts.
Ghidra (IsfServer / Debugger ISF Server) isf_server_enabled = false - Compensating control
Block or restrict access to TCP port 54321 at the network perimeter or host firewall to only trusted management hosts, or otherwise isolate hosts running Ghidra from untrusted networks to prevent remote connections to the IsfServer.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52756?
The severity of CVE-2026-52756 is medium with a score of 6.3.
How do I fix CVE-2026-52756?
To fix CVE-2026-52756, update Ghidra to version 12.2 or later.
What type of vulnerability is CVE-2026-52756?
CVE-2026-52756 is an unauthenticated path traversal vulnerability.
What can attackers do with CVE-2026-52756?
Attackers can exploit CVE-2026-52756 to perform unauthorized filesystem operations on the server.
Which software is affected by CVE-2026-52756?
CVE-2026-52756 affects versions of Ghidra prior to 12.2.