Path Traversal in Radare Radare2
CVE-2026-6940
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (8.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000
Affected products
- Radare Radare2
- Radareorg Radare2 — versions 0
Weakness classification (CWE)
References
- Pull Request (issue-tracking, Exploit, technical-description, exploit, Third Party Advisory, Issue Tracking)
- Patch Commit (issue-tracking, Patch, Issue Tracking)
- www.vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-6940?
- CVE-2026-6940 is a high-severity vulnerability in Radare Radare2, classified under Path Traversal. CVSS score: 7.1/10. Published 2026-04-23.
- How severe is CVE-2026-6940?
- High severity. CVSS v3 base score is 7.1 out of 10.