CVE-2026-52755: falha de alta gravidade em nationalsecurityagency ghidra
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.2%
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nationalsecurityagency · ghidraCVEs relacionadas — nationalsecurityagency ghidra
No mesmo produto, das mais perigosas para as menos.
CVE-2026-52751HIGHGhidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project ConnectionEPSS 0.7%CVE-2026-52750HIGHGhidra < 12.1- Command Injection via URL Annotation ClickEPSS 0.5%CVE-2026-52756MEDIUMGhidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF ServerEPSS 0.5%CVE-2026-52758HIGHGhidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim SearchEPSS 0.3%CVE-2026-49498HIGHGhidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped UsernameEPSS 0.3%CVE-2026-52754HIGHGhidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModuleEPSS 0.3%