Path Traversal in Ghidra Theme Import

Executive Summary

CVE-2026-52755 is a path traversal vulnerability in Ghidra's theme import functionality affecting versions before 12.0.4.

Attackers can craft malicious theme ZIP files containing directory traversal sequences (like "../") in filenames. When a user imports such a theme ZIP, the software extracts files without properly validating the file paths.

This allows attackers to write files outside the intended theme directory, potentially overwriting or creating files in sensitive locations where the user has write access.

Examples of sensitive files that can be modified include .bashrc, .profile, or .ssh/authorized_keys, which can lead to arbitrary code execution or unauthorized remote access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including arbitrary code execution and compromise of sensitive user files.

• Attackers can execute arbitrary code by writing malicious files that run automatically.
• Sensitive files such as .bashrc or .ssh/authorized_keys can be modified, potentially granting attackers unauthorized remote access.
• The integrity, confidentiality, and availability of your system and data can be severely affected.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the import of malicious theme ZIP files containing path traversal sequences like "../" in filenames. Detection involves monitoring or inspecting theme import activities in Ghidra versions prior to 12.0.4.

You can check for suspicious ZIP files with traversal sequences by inspecting theme ZIP files before import. For example, use commands to list ZIP contents and look for filenames containing "../" or absolute paths.

• Use the command: unzip -l suspicious_theme.zip | grep '\.\./'
• Alternatively, use: zipinfo suspicious_theme.zip | grep '\.\./'

Additionally, monitor file system changes in user home directories for unexpected modifications to files like .bashrc or .ssh/authorized_keys after theme imports.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Ghidra to version 12.0.4 or later, where the vulnerability has been fixed by validating file paths during theme import.

Until the upgrade is applied, avoid importing theme ZIP files from untrusted sources to prevent exploitation.

Review and monitor critical user files such as .bashrc, .profile, and .ssh/authorized_keys for unauthorized changes.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to write arbitrary files outside the intended directory, potentially modifying sensitive files such as .bashrc or .ssh/authorized_keys. This can lead to unauthorized code execution or unauthorized access to sensitive data.

Such unauthorized access or modification of sensitive files could result in violations of data protection and security requirements mandated by common standards and regulations like GDPR and HIPAA, which require safeguarding the confidentiality, integrity, and availability of sensitive information.

Therefore, if exploited, this vulnerability could compromise compliance with these regulations by enabling unauthorized data access or system compromise.

Useful 0 Not Useful 0