CVE-2026-49497 is a path traversal vulnerability in the nationalsecurityagency's Ghidra software before version 12.1. The issue exists in the SameDirDebugInfoProvider, which does not properly validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. An attacker can craft malicious ELF binaries containing directory traversal sequences to cause Ghidra to access files outside the intended directory. This can be used to probe the filesystem and leak CRC32 hashes of arbitrary files during the DWARF debug information analysis process.

An attacker can leverage this vulnerability to probe the presence of files on the filesystem and leak CRC32 hashes of arbitrary files. This may lead to information disclosure about the target system's file structure and contents. The vulnerability does not require privileges and can be triggered with user interaction, but it has limited impact as it does not allow direct code execution or full file disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid analyzing untrusted ELF binaries with Ghidra versions prior to 12.1 to reduce exposure.