CVE-2026-6940 Details
Description
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
A path traversal vulnerability has been identified in radare2 versions prior to 6.1.4, specifically within the project deletion feature. This vulnerability allows local attackers to recursively delete arbitrary directories by providing absolute paths that escape the designated project directory. By crafting paths to project marker files outside the intended storage area, attackers can manipulate the deletion process to target specific directories. The deletion occurs with the permissions of the radare2 process, leading to potential loss of integrity and availability.
Users can update to radare2 version 6.1.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/radareorg/radare2/pull/25830 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://github.com/radareorg/radare2/pull/25830/commits | [email protected] | Issue TrackingPatch |
| https://www.vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-deletion | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| radare radare2 | < 6.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |