PatchTheCVECVE-2026-52755: Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows att
CVE-2026-52755 is a high-severity flaw (CVSS 7.8) affecting ghidra. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-06-10 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-52755?
ghidra: upgrade to 12.0.4. Exact commands for each OS are on this page.
Is CVE-2026-52755 being exploited?
CVE-2026-52755 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-52755 affect?
CVE-2026-52755 affects ghidra. Severity is high (CVSS 7.8). Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences
How urgent is CVE-2026-52755?
Priority 35/100. High severity; Public exploit reference
Related CVEs
- CVE-2026-52751 HIGH 8.8 UPGRADE Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connecti
- CVE-2026-52750 HIGH 7.8 UPGRADE Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.
- CVE-2026-52756 MEDIUM 4.8 UPGRADE Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP
- CVE-2026-49498 HIGH 8.8 UPGRADE Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunct
- CVE-2026-52752 HIGH 7.8 UPGRADE Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate