Path traversal in Ghidra - CVE-2026-49497
Published: May 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU131576
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49497
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in SameDirDebugInfoProvider when processing a crafted ELF binary with a .gnu_debuglink filename during automatic DWARF analysis. A remote attacker can supply a specially crafted ELF binary to disclose sensitive information.
User interaction is required to open the crafted ELF binary, and in headless analysis environments the resulting log output may be captured and returned to the submitter.
Affected software
Ghidra
How to mitigate CVE-2026-49497
Install security update from vendor's website.
Ghidra - update to 12.1