A flaw in the theme import feature of Ghidra allows an attacker to construct a ZIP file containing filenames that traverse directories, thereby writing files outside the intended theme directory. The vulnerability can be exploited to overwrite critical files such as .bashrc or .ssh/authorized_keys, which may lead to arbitrary code execution or unauthorized privileged access. The weakness is classified as CWE‑22, an Absolute or Relative Path Traversal flaw.

All installations of Ghidra with a version earlier than 12.0.4 from the National Security Agency include the vulnerable theme import functionality. No specific sub‑versions are listed; therefore any release prior to 12.0.4 is potentially affected.

The CVSS score of 8.4 indicates a high severity of the vulnerability. While the EPSS score is not available and the flaw is not currently in the CISA KEV catalog, the nature of the attack—requiring the submission of a malicious theme ZIP—suggests that exploitation is likely to be limited to environments where users have the ability to import themes, such as local users or remote users with access to the import interface. Once a malicious theme is imported, the attacker can influence files in the host filesystem, providing the ability to modify or replace critical configuration files.