CVE-2026-52756 is a path traversal vulnerability affecting the IsfServer in Ghidra before version 12.2. The IsfServer listens on TCP port 54321 and accepts client-supplied namespace strings that are directly used in filesystem operations without validation. This lack of input sanitization enables remote attackers to craft protobuf messages containing path traversal sequences to enumerate filesystem directories and access arbitrary files. The vulnerability requires no authentication and has a medium severity rating with a CVSS 4.0 score of 6.3. No official patch or remediation level has been provided at this time.

Remote attackers can connect unauthenticated to the IsfServer on port 54321 and exploit the path traversal vulnerability to enumerate filesystem paths and probe arbitrary files. This could lead to unauthorized disclosure of sensitive information stored on the affected system. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to port 54321 to trusted hosts only and monitor for unusual connections to this port. Avoid exposing the IsfServer to untrusted networks.