Brief Summary: Ghidra Extension Installer Zip Slip Vulnerability (CVE-2026-52752)

Introduction

A path traversal vulnerability in Ghidra's extension installer lets attackers write arbitrary files to a victim's filesystem. The attacker only has to convince the victim to install a crafted extension ZIP. That turns a trusted reverse engineering tool into a potential attack vector against the analysts who depend on it. The flaw, tracked as CVE-2026-52752, affects all Ghidra versions before 12.0.2 and has a CVSS v3.1 score of 8.8, according to the GitHub Security Advisory.

Ghidra is a software reverse engineering framework that the NSA developed and released as open-source software. It has approximately 61,000 GitHub stars and is widely used across government agencies, security research firms, and academic institutions, which makes it one of the most popular free alternatives to commercial disassemblers like IDA Pro. The vulnerability is in the extension system, which is central to how Ghidra is extended and to the community built around it.

Technical Information

CVE-2026-52752 is a classic "Zip Slip" vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The vulnerable code is in Ghidra/Framework/Generic/src/main/java/ghidra/util/extensions/ExtensionUtils.java, at approximately line 579. During extraction, the installer takes entry.getName() from each ZIP archive entry and uses it directly to build the target file path, without checking it for directory traversal sequences.

If an entry's filename contains ../ sequences, the resolved destination path escapes the extension installation directory, and the extracted file is written to an arbitrary location on the filesystem.

CVSS Scoring

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-accessible, low-complexity attack that requires user interaction and has high impact on confidentiality, integrity, and availability. The CVSS v4.0 vector uses a local attack vector with active user interaction, and also rates the impact high on all three.

Attack Flow

The exploitation chain has five steps:

1. The attacker creates a ZIP file with a valid Ghidra extension structure, including the required extension.properties metadata file, plus one or more entries whose filenames contain path traversal sequences. For example, an entry named TestExtension/../../../../../EXPLOIT.sh would resolve to the user's home directory instead of the extensions folder.

2. The attacker gets the ZIP to a target user through social engineering, a compromised extension repository, or a watering-hole attack aimed at the reverse engineering community.

3. The victim installs the extension through the standard Ghidra workflow: File, then Install Extensions, then the malicious ZIP file.

4. During extraction, the traversal sequences in the ZIP entry names send files outside the intended installation directory. Because entry.getName() is used without path validation, the filesystem resolves the ../ sequences and the attacker's payload lands at an arbitrary location.

5. If the payload overwrites a shell configuration file such as .bashrc or .profile, the attacker gets arbitrary code execution the next time the user opens a terminal session.

Proof of Concept Structure

The proof-of-concept ZIP documented in the GitHub Security Advisory contains:

• TestExtension/ (directory)
• extension.properties (valid metadata file required by Ghidra)
• TestExtension/../../../../../EXPLOIT.sh (payload file with traversal path)

The PoC overwrites the user's shell configuration so that it launches a calculator application, a harmless way to show the arbitrary code execution capability.

Connection to CVE-2019-13623

This vulnerability belongs to the same CWE-22 class that affected Ghidra before version 9.1. CVE-2019-13623 was a path traversal vulnerability in RestoreTask.java (package ghidra.app.plugin.core.archive). That earlier flaw was fixed with the FileUtilities.isPathContainedWithin() validation pattern in JarDecompiler.java. The same validation was never applied to the extension installer code path in ExtensionUtils.java, so the identical class of vulnerability resurfaced approximately seven years later.

The fix for CVE-2026-52752 adds the same FileUtilities.isPathContainedWithin() check before extraction, so the resolved destination path must stay within the target extension directory. Whether other archive extraction code paths in Ghidra still lack this validation is an open question.

Affected Systems and Versions

All versions of Ghidra before 12.0.2 are affected. The vulnerability is in the extension installer component, specifically in ExtensionUtils.java. Any Ghidra installation where users install extensions through the standard File menu workflow is vulnerable.

The fix is available in Ghidra 12.0.2 and later.

Vendor Security History

The NSA's security record with Ghidra shows a pattern of path traversal and archive handling vulnerabilities:

CWE-22 has now appeared in two distinct code paths approximately seven years apart, which indicates a systemic gap in how consistently secure archive extraction patterns are applied across the Ghidra codebase. The fix for CVE-2019-13623 stayed local to JarDecompiler.java and was never carried over to the extension installer. That suggests the project would benefit from a codebase-wide audit of all archive extraction routines.

The advisory for CVE-2026-52752 was published on February 2, 2026 by emteere. Discovery is credited to researchers @PrasanthSundararajan69 and Finder16. External security researchers have contributed to Ghidra's security before. Oceanit's Software and Cybersecurity team found and fixed a separate vulnerability through responsible disclosure with the NSA.

References

• NVD: CVE-2026-52752
• GitHub Security Advisory: Zip Slip Path Traversal in Ghidra Extension Installer (GHSA-jhc2-q7qf-9c25)
• VulnCheck Advisory: Ghidra Path Traversal in Extension Installer via ZIP Entry Names
• NVD: CVE-2019-13623 (Prior Ghidra Path Traversal)
• NVD: CVE-2019-13625 (Prior Ghidra XXE)
• Ghidra GitHub Repository
• NSA Ghidra Official Page
• Android Developer Documentation: Zip Path Traversal
• Ghidra Vulnerability History (CIRCL)
• Oceanit: Fixing Vulnerability in NSA Cybersecurity Tool
• Ghidra Extension Installation Documentation