Path Traversal in Ghidra Theme Import Functionality

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Ghidra, the open-source reverse engineering framework developed by the NSA, contains a critical path traversal vulnerability (CWE-22) in its theme import feature affecting versions before 12.0.4. When users import a malicious theme packaged as a ZIP file, attackers can exploit directory traversal sequences in filenames to write files outside the intended theme directory. This allows arbitrary code execution or modification of sensitive system files like shell configuration files (.bashrc) and SSH keys (.ssh/authorized_keys). Security researchers, penetration testers, malware analysts, and software developers who use Ghidra are at risk, particularly if they accept theme files from untrusted sources or work in environments where supply chain attacks are a concern.

Casky's 331 matched skills enable practitioners to detect this attack pattern by mapping to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Using Claude's extended reasoning capabilities, the platform identifies suspicious indicators such as ZIP file extraction processes with path traversal sequences (../ or ..\ in filenames), unexpected file write operations to system directories during theme imports, and modification of shell configuration or SSH credential files following Ghidra theme loading. Practitioners would receive findings highlighting anomalous file system activity patterns, unintended directory traversal attempts captured in application logs, and correlations between theme import events and sensitive file modifications—enabling them to detect exploitation attempts before malicious code execution occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-52755.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-52755

Casky has 331 skills that investigate the attack patterns behind CVE-2026-52755. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn