CVE-2026-52758: Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1 - Compensating control
Restrict or block access to the BSim network query protocol from untrusted networks (for example via firewall rules, network ACLs, or host-based firewalls) until Ghidra is upgraded to the fixed version.
- Operational
If exploitation is suspected or confirmed, treat as potential PostgreSQL compromise: review database logs and audit for unauthorized reads/changes/deletions, rotate database credentials and any potentially exposed secrets, and restore affected data from known-good backups as necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52758?
The severity of CVE-2026-52758 is rated as high, with a score of 8.7.
How do I fix CVE-2026-52758?
To fix CVE-2026-52758, upgrade Ghidra to version 12.1 or later which addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-52758?
CVE-2026-52758 is an SQL Injection vulnerability that allows attackers to inject arbitrary SQL code.
Who is affected by CVE-2026-52758?
Users of Ghidra versions prior to 12.1 are affected by CVE-2026-52758.
Can CVE-2026-52758 allow data manipulation?
Yes, CVE-2026-52758 allows remote attackers to read, modify, or delete data due to the SQL injection flaw.