QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-6940

Back to search

CVE-2026-6940

Published: Apr 23, 2026

Modified: Apr 24, 2026

PUBLISHED

CVSS v3.1

7.1

HIGH

Description

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

VendorProductVersions

radareorg

radare2

unaffected
0 - < e5fcf56fe038760c872c6dbed432602778fde1ed git
affected
0 - < 6.1.4

Weaknesses (CWE)

CWE-22

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

References

Pull Request
technical-description
exploit
Patch Commit
issue-tracking

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now