Ghidra versions earlier than 12.0.2 allow a path traversal flaw in the extension installer because ZIP entry names are not validated during extraction. An attacker can craft a malicious extension package that contains filenames with traversal sequences such as "../" and cause the installer to write files outside the intended directory. This arbitrary write capability can lead to the execution of malicious code in the environment where Ghidra is running.

The National Security Agency’s Ghidra product is affected, specifically all releases prior to 12.0.2. No other vendors or products are currently listed as impacted.

The CVSS score is 8.4, which indicates a high severity vulnerability. EPSS data is not available, so the current likelihood of exploitation is unknown, and the issue is not listed in the CISA KEV catalog. The exploit requires delivery of a crafted ZIP file to a user who then installs or imports the malicious extension. The attack vector can be both local—if an attacker has access to the user’s machine—and remote—if the malicious extension is distributed through shared repositories, email, or other remote channels. Successful exploitation would allow an attacker to write arbitrary files and execute code within the scope of the user’s Ghidra installation.