CVE-2026-49497CWE-22

Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution

Medium · published June 10, 2026

CVSS v4.0
4.6
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-10T12:37Z
EPSS history
Timeline
  • 10 JUN 12:37Z
    Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution
    cvelistv5