Path traversal in Ghidra - #VU131578
Published: May 15, 2026 / Updated: May 16, 2026
Vulnerability identifier: #VU131578
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in Debugger ISF Server when processing client-supplied namespace strings over TCP connections. A remote attacker can send a specially crafted protobuf request to disclose sensitive information.
User interaction is required because the server must first be manually launched, and differential error responses can reveal whether targeted filesystem paths exist.
Affected software
Ghidra
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.