CVE-2026-52755: Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import

Synopsis

A path traversal vulnerability (Zip Slip) in Ghidra's theme import functionality allows a crafted ZIP file to write files outside the intended theme directory. The attack requires local access and a user to open a malicious theme archive, but does not require any account credentials. Successful exploitation lets an attacker overwrite arbitrary files on the host, enabling code execution by tampering with files such as .bashrc or .ssh/authorized_keys. A patched-image rebuild at version 12.0.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to deliver the malicious theme file.

• AuthenticationNot required

  No account credentials or privilege level are required; the vulnerability is exercised through the theme import UI without any authentication check.

• Victim interactionRequired

  A user must actively open or import the malicious theme ZIP file, making this a social-engineering vector where the attacker must convince the victim to load the crafted archive.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim loads the file; no race conditions, memory layout assumptions, or environmental factors are involved.

Blast Radius

• Writes arbitrary files anywhere on the filesystem that the running user can reach, including shell startup scripts such as .bashrc to achieve persistent code execution on next login.
• Overwrites or appends to .ssh/authorized_keys, granting the attacker SSH access to the host without any further credentials.
• Modifies or replaces any user-writable configuration or binary, leading to full compromise of the local user account running Ghidra.