The vulnerability is a path traversal flaw in the IsfServer component of Ghidra, where client‑supplied namespace strings are used directly in file system operations without validation. Remote attackers can communicate over the listening TCP port, craft protocol messages containing traversal sequences, and obtain directory listings or read arbitrary file contents. This flaw results in information disclosure and potential exposure of sensitive configuration or source files, impacting confidentiality.

The affected product is Ghidra from the National Security Agency, versions earlier than 12.2. No specific sub‑version ranges are listed, so any release before 12.2 contains the flaw.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, suggesting it has not yet been targeted by known exploits. Attackers can exploit the flaw remotely by connecting to port 54321 and sending crafted protobuf messages; no authentication is required, making the attack surface wide and accessible from any network host with connectivity to the Ghidra instance.