CVE-2026-49497

Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution

State: Published
Severity: 4.6 Medium
Published: Jun 10, 2026
Updated: Jul 14, 2026
Reserved: May 31, 2026

Description

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.

Scores

CVSS	Score	Vector	Source
4.0	4.6 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
ghidranationalsecurityagency	before 12.1Affected 12.1Not affected

References

GitHub Security Advisory (GHSA-57g6-7qw2-p5hx)vendor-advisory
https://www.vulncheck.com/advisories/ghidra-path-traversal-via-gnu-debuglink-in-dwarf-external-debug-file-resolutionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.