CVE-2026-52752 is a path traversal vulnerability in the National Security Agency's Ghidra software before version 12.0.2. The issue exists in the extension installer component, which does not properly validate ZIP entry names during extraction. Maliciously crafted extensions can include directory traversal sequences in filenames, enabling attackers to write files outside the designated directory. This can result in arbitrary file writes and potentially allow code execution on the affected system. The vulnerability has a CVSS 4.0 base score of 8.4, indicating high severity. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to write arbitrary files outside the intended directory via crafted extension ZIP files. This can lead to code execution, compromising the affected system's integrity and security. The vulnerability requires local access (AV:L) and user interaction (UI:A) but does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid installing untrusted or unverified extensions. Monitor official National Security Agency or Ghidra project channels for updates and apply patches promptly once available.