Brief Summary: Ghidra Theme Import Zip Slip Path Traversal (CVE-2026-52755)

Introduction

The NSA's Ghidra reverse engineering framework, a tool used daily by malware analysts and security researchers to dissect untrusted binaries, contains a path traversal vulnerability in its theme import feature that lets an attacker write arbitrary files to a victim's filesystem. A tool built to analyze threats can itself become the attack vector, and this is the second time the same class of vulnerability (Zip Slip) has appeared in Ghidra's codebase.

Technical Information

Root Cause

CVE-2026-52755 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerable code is in Ghidra/Framework/Docking/src/main/java/docking/theme/gui/ThemeUtils.java, where ZIP entry names are used directly to build file paths, with no validation against the intended extraction root directory.

When a user imports a theme through the menu path Edit -> Theme -> Import, Ghidra extracts the contents of a theme ZIP file to the theme directory. The extraction logic does not check whether the resolved path of each ZIP entry falls within the target directory. This is the textbook Zip Slip pattern. If a ZIP entry has ../ sequences in its filename, the extracted file lands outside the intended directory.

CVSS Scoring

The vulnerability carries different CVSS scores depending on the version used:

• CVSS v3.1: 8.8 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• CVSS v4.0: 8.4 (High), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The initial CVE record lists a score of 7.8, which likely reflects a different scoring version or enrichment state. Whichever score you use, all of them fall in the High severity range.

Attack Flow

Exploitation follows a well-understood sequence:

1. The attacker creates a malicious theme ZIP. It contains legitimate theme entries (e.g., ThemeZip/Theme.theme and ThemeZip/images/icon.png) alongside one or more entries with path traversal sequences in their filenames, such as images/../../../../payload.sh.

2. The attacker delivers the malicious ZIP to the target through social engineering. Ghidra users routinely share configuration files, scripts, and customizations through community forums, GitHub repositories, or direct collaboration, so a malicious theme distributed through these channels could appear entirely legitimate.

3. The target user opens Ghidra, navigates to Edit -> Theme -> Import, and selects the malicious ZIP file.

4. During extraction, the ../ sequences in the malicious entry's filename cause the file to be written outside the theme directory. For example, images/../../../../payload.sh resolves to the user's home directory rather than the theme images subdirectory.

5. The file write gives the attacker code execution or persistent access, with the outcome depending on which file is targeted:

In the GitHub security advisory's demonstration, a payload script written to the user's home directory and executed with bash ~/payload.sh opened the Calculator application, which confirms arbitrary code execution.

The Fix

Ghidra 12.0.4 adds a canonical path validation check using FileUtilities.isPathContainedWithin(). It is the same defensive pattern previously applied in JarDecompiler.java to fix CVE-2019-13623. The code change is:

File destination = new File(filePath);
if (!FileUtilities.isPathContainedWithin(targetDir, destination)) {
    throw new IOException("Zip entry escapes target directory: " + entry.getName());
}

Before any file is written, the check validates the canonical resolved path of each ZIP entry's destination against the target extraction directory, so traversal sequences cannot escape the intended boundary.

Discovery

Security researcher @PrasanthSundararajan69 reported the vulnerability. The CVE was sourced through [email protected].

Affected Systems and Versions

All versions of Ghidra prior to 12.0.4 are affected. The vulnerability is specific to the theme import functionality in ThemeUtils.java.

• Vulnerable: Ghidra versions before 12.0.4
• Fixed: Ghidra 12.0.4, released March 4, 2026

Organizations running Ghidra 12.0.4 or later are already protected. The risk is concentrated on deployments running older versions, particularly those that may not have updated because the patch came out approximately three months before the CVE was published.

Exploitation requires user interaction. A user must explicitly import a malicious theme ZIP file through the Ghidra GUI, so remote exploitation without social engineering is not possible.

Vendor Security History

Ghidra's security record shows a recurring pattern of vulnerabilities in how it processes externally supplied files:

CWE-22 path traversal is the class that keeps coming back. CVE-2019-13623 and CVE-2026-52755 are both Zip Slip variants in archive extraction code paths. The fix for CVE-2019-13623 introduced the FileUtilities.isPathContainedWithin() utility method, but nobody audited the theme import code path in ThemeUtils.java for the same class of vulnerability at that time. The defensive utility sat in the codebase for seven years before it was applied to this second vulnerable code path.

This pattern suggests Ghidra would benefit from a systematic audit of all archive-handling code paths. The vulnerabilities consistently involve Ghidra processing externally supplied files (archives, project files, binaries with annotations, theme files). Processing such files is inherent to the tool's purpose as a reverse engineering framework, and it demands rigorous input validation on every code path that does it.

On vulnerability management, the Ghidra team has stated that they are "currently not authorized to generate CVEs from security advisories" and that "it will be the responsibility of the original reporter to generate a CVE." Under this policy, CVE assignment may lag behind advisory publication, which can complicate vulnerability tracking for organizations that rely on automated CVE-based systems.

References

• NVD: CVE-2026-52755
• GitHub Security Advisory: Zip Slip Path Traversal in Ghidra Theme Import (GHSA-3r55-xjr4-jh8f)
• VulnCheck Advisory: Ghidra Path Traversal via Zip Slip in Theme Import
• Ghidra Releases (GitHub)
• Ghidra Security Advisories (GitHub)
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• NVD: CVE-2019-13623 (Prior Ghidra Zip Slip)
• CISA Known Exploited Vulnerabilities Catalog
• Ghidra (Wikipedia)
• NSA Ghidra Announcement