CVE-2026-52756 is a path traversal vulnerability affecting the IsfServer in Ghidra before version 12.2. The vulnerability arises because the server accepts TCP connections and directly passes client-supplied namespace strings to filesystem operations without validating or sanitizing them. Remote attackers can exploit this by connecting to port 54321 and sending specially crafted protobuf messages containing path traversal sequences, which can lead to unauthorized enumeration of filesystem paths and access to arbitrary files.

An unauthenticated remote attacker can connect to the vulnerable IsfServer and exploit the path traversal flaw to enumerate filesystem paths and access arbitrary files. This could lead to information disclosure of sensitive files on the host running Ghidra. The CVSS 4.0 base score is 6.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, and limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the National Security Agency or Ghidra project advisories for updates. Until a fix is available, restricting network access to port 54321 and disabling the IsfServer if not needed may reduce exposure.