CVE-2026-6940
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
View on NVDAnalysis
Radare2 versions prior to 6.1.4 contain a path traversal vulnerability in the project deletion logic. A local attacker or a malicious project file could cause the recursive deletion of arbitrary directories on the system with the permissions of the radare2 process.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HCWE-22EPSS
Affects
radare:radare2Technical description
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.