CVE-2026-6940
radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
- State
- Published
- Severity
- 6.9 Medium
- Published
- Apr 23, 2026
- Updated
- Jul 14, 2026
- Reserved
- Apr 23, 2026
Description
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
radare2radareorg |
|
References
- Pull Requestissue-tracking
- Patch Commitissue-tracking
- https://www.vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-deletionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.