Vulnerability · Published Apr 23, 2026 · Assigned by VulnCheck

CVE-2026-6940radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion

High 7.1

In plain English

A high-severity path traversal in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:25.10	radare2	no fix listed	UBUNTU-CVE-2026-6940
Ubuntu:26.04:LTS	radare2	no fix listed	UBUNTU-CVE-2026-6940
Ubuntu:26.10	radare2	no fix listed	UBUNTU-CVE-2026-6940

Affected products (as reported)

Vendor	Product	Versions
radareorg	radare2	0 – before 6.1.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

Pull Request issue-tracking
Patch Commit issue-tracking
https://www.vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-deletion third-party-advisory