EUVD-2026-36015Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.
AnalysisAI
Path traversal in Ghidra's IsfServer component (all versions before 12.2) allows remote unauthenticated attackers to enumerate filesystem paths and probe arbitrary files by connecting to TCP port 54321 and sending crafted protobuf messages. The root cause is unsanitized client-supplied namespace strings passed directly to filesystem operations, a CWE-22 defect. Given Ghidra's deployment context - security research, malware analysis, and reverse engineering of sensitive artifacts, often in high-value government and defense environments - successful exploitation could expose directory structures and sensitive file metadata on the analyst's workstation. No public exploit code has been identified and this vulnerability is not in CISA KEV at time of analysis.
Technical ContextAI
Ghidra is NSA's open-source software reverse engineering (SRE) framework (CPE: cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:*). The vulnerable component, IsfServer, is part of Ghidra's Debugger subsystem and listens on TCP port 54321 for client connections, using Protocol Buffers (protobuf) as its serialization format for inter-process or remote communication during debug sessions. The CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) root cause is the server's failure to sanitize or validate namespace strings submitted by clients before passing them to underlying filesystem operations. An attacker who controls the namespace field in a protobuf message can inject sequences such as '../../../' to escape the intended directory context and reach arbitrary filesystem paths. The CVSS 4.0 Attack Requirements metric is set to 'Present' (AT:P), reflecting that the IsfServer must be actively running and network-reachable for exploitation to occur.
RemediationAI
The primary fix is upgrading to Ghidra 12.2 or later, which resolves the unsanitized namespace string handling in IsfServer per the vendor advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2. If immediate upgrade is not feasible, restrict network access to TCP port 54321 using host-based or network firewall rules so that only trusted local addresses can reach the IsfServer - this eliminates the network attack vector entirely with no functionality loss for single-user workstation deployments. Alternatively, disable the IsfServer component when remote debugging or collaborative session features are not actively required; this removes the attack surface at the cost of those specific workflow capabilities. Do not rely on perimeter firewall controls alone if Ghidra is used on shared analysis servers accessible from broader network segments. Organizations running Ghidra in air-gapped environments with no external TCP access to port 54321 face negligible practical risk from this vulnerability.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today