Path traversal in Ghidra - #VU158270
Published: October 28, 2026
Vulnerability details
The vulnerability allows a remote attacker to create or overwrite files outside the selected output directory under the Ghidra user's privileges, potentially executing arbitrary code or causing a denial of service.
The vulnerability exists due to path traversal in Ghidra's SplitMultiplePefContainersScript when constructing output paths from unchecked Code Fragment Manager member names. A remote attacker can trick a user into running the script on a crafted PEF data fork and AppleDouble resource fork containing a member name such as ../GHIDRA_CFRG_ESCAPE_MARKER.txt to write attacker-chosen bytes outside the selected directory. Writing to automatically loaded locations may execute code when the affected application or user session next starts, while destructive overwrites may prevent tools from starting.
Existing destination files trigger an overwrite confirmation, whereas new files are created without an additional path warning.