CVE-2026-52752 is a path traversal vulnerability affecting Ghidra before version 12.0.2. The issue exists in the extension installer component, which does not properly validate ZIP entry names during extraction. Attackers can exploit this by crafting malicious extension ZIP files containing directory traversal sequences such as '../' in filenames, enabling them to write files outside the designated directory. This can lead to arbitrary file write and potentially code execution within the context of the user running Ghidra. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4. There is no vendor advisory or patch currently available, and the remediation level is unknown.

Exploitation of this vulnerability allows an attacker to write arbitrary files outside the intended directory of the Ghidra extension installer. This can lead to unauthorized code execution or modification of critical files, compromising the security of the affected system. The attack requires local access (AV:L) and user interaction (UI:A), but no privileges or authentication are needed. The vulnerability does not affect confidentiality, integrity, or availability directly but enables high-impact code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid installing untrusted or third-party extensions in Ghidra. Restrict access to the extension installer and run Ghidra with the least privileges necessary to limit potential impact.