CVE-2026-6940: radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.1.4 - Compensating control
Ensure local attackers cannot trigger radare2 project deletion via the vulnerable code path (e.g., restrict access to the radare2 process/interface to trusted users/hosts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6940?
CVE-2026-6940 is considered a high severity vulnerability due to its ability to allow local attackers to delete arbitrary directories.
How do I fix CVE-2026-6940?
To fix CVE-2026-6940, update to radare2 version 6.1.4 or later.
Who is affected by CVE-2026-6940?
CVE-2026-6940 affects all versions of radare2 prior to 6.1.4.
What type of vulnerability is CVE-2026-6940?
CVE-2026-6940 is a path traversal vulnerability that permits directory deletion.
Can CVE-2026-6940 be exploited remotely?
CVE-2026-6940 is a local vulnerability, meaning it requires local access to the system to be exploited.