CVE-2026-6941 Details
Description
radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.
A path traversal vulnerability has been identified in radare2 versions prior to 6.1.4. This vulnerability arises in the project's notes management, allowing attackers to read or write files outside the designated project directory. The issue is exploited by importing a malicious .zrp archive that contains a symlinked notes.txt file. The crafted archive can bypass directory confinement checks, enabling note operations to follow the symlink and access arbitrary files outside the project's root directory.
Users can update to radare2 version 6.1.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/radareorg/radare2/commit/4bcdee725ff0754ed721a98789c0af371c5f32a4 | [email protected] | Patch |
| https://github.com/radareorg/radare2/pull/25831 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://www.vulncheck.com/advisories/radare2-project-notes-path-traversal-via-symlink | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| radare radare2 | < 6.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |