CVE-2026-6941: radare2 < 6.1.4 Project Notes Path Traversal via Symlink
radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.1.4 - Compensating control
If upgrading immediately is not possible, restrict or block importing of untrusted .zrp archives (which may contain symlinked notes.txt) to prevent note operations from following symlinks outside the dir.projects root directory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6941?
CVE-2026-6941 has a medium severity rating due to its ability to allow unauthorized file access.
How do I fix CVE-2026-6941?
To fix CVE-2026-6941, upgrade radare2 to version 6.1.4 or later.
What does CVE-2026-6941 exploit?
CVE-2026-6941 exploits a path traversal vulnerability in radare2's project notes handling.
What can attackers do with CVE-2026-6941?
Attackers can read or write files outside the configured project directory due to this vulnerability.
Which versions of radare2 are affected by CVE-2026-6941?
CVE-2026-6941 affects all versions of radare2 prior to 6.1.4.