CVE-2026-6940
High
Description
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
SeverityHigh
CVSS7.1
Exploit probability—
ProductRadare2
PublishedApr 23, 2026
First seenApr 23, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- radare radare26.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| radare radare2 | v < 6.1.4 | 6.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.