EUVD-2026-36014Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.
AnalysisAI
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the theme directory via Zip Slip path traversal sequences in malicious theme ZIP archives, leading to code execution or credential compromise. The flaw requires user interaction (importing the booby-trapped theme) and is exploited locally against the user running Ghidra. No public exploit identified at time of analysis, though the technique (Zip Slip) is well-documented and trivially reproducible.
Technical ContextAI
Ghidra is the open-source software reverse engineering (SRE) suite developed and maintained by the U.S. National Security Agency (per CPE cpe:2.3:a:nationalsecurityagency:ghidra). The vulnerability sits in the theme import routine, which extracts user-supplied ZIP archives without sanitizing entry filenames - a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) instance commonly called 'Zip Slip.' When archive entries contain '../' sequences, the extractor resolves paths outside the intended theme directory, allowing the attacker to drop or overwrite arbitrary files anywhere the Ghidra process has write permission, including dotfiles like ~/.bashrc or ~/.ssh/authorized_keys that grant code execution or persistent access on next shell login or SSH connection.
RemediationAI
Upgrade to Vendor-released patch: Ghidra 12.0.4 or later, available from the NSA Ghidra GitHub releases page and referenced in advisory GHSA-3r55-xjr4-jh8f (https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-3r55-xjr4-jh8f). Until upgrading, the most effective compensating control is to refuse to import theme ZIPs from untrusted sources - only load themes shipped with Ghidra or built locally; this has no functional side effect beyond losing access to third-party themes. As an additional hardening step, run Ghidra under a dedicated low-privilege user account whose home directory contains no SSH keys, shell rc files, or other code-execution sinks, so a successful traversal write lands on a non-actionable file; the trade-off is the operational overhead of managing a second user profile. Reviewing recently imported themes and auditing ~/.bashrc, ~/.profile, and ~/.ssh/authorized_keys for unexpected modifications is also recommended on hosts that may have already imported untrusted archives.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA Ghidra versions prior to 12.0.2 allows local attackers to achieve code execution by tricking
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today