CVE-2026-6940: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in radareorg radare2
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
AI Analysis
Technical Summary
CVE-2026-6940 is a path traversal vulnerability (CWE-22) in radareorg's radare2 software before version 6.1.4. The issue occurs in the project deletion feature, where an attacker with local access can supply absolute paths that bypass the configured root directory for projects. This allows recursive deletion of directories outside the intended boundary, using the permissions of the radare2 process. The vulnerability impacts data integrity and availability by enabling deletion of arbitrary files and directories.
Potential Impact
Local attackers can exploit this vulnerability to recursively delete arbitrary directories outside the intended project storage area. This can result in significant loss of data integrity and availability, depending on the permissions of the radare2 process. There is no indication of confidentiality impact. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to systems running vulnerable versions of radare2 and avoid running radare2 with elevated privileges. Monitor for updates from radareorg regarding patches or official mitigations.
CVE-2026-6940: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in radareorg radare2
Description
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6940 is a path traversal vulnerability (CWE-22) in radareorg's radare2 software before version 6.1.4. The issue occurs in the project deletion feature, where an attacker with local access can supply absolute paths that bypass the configured root directory for projects. This allows recursive deletion of directories outside the intended boundary, using the permissions of the radare2 process. The vulnerability impacts data integrity and availability by enabling deletion of arbitrary files and directories.
Potential Impact
Local attackers can exploit this vulnerability to recursively delete arbitrary directories outside the intended project storage area. This can result in significant loss of data integrity and availability, depending on the permissions of the radare2 process. There is no indication of confidentiality impact. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to systems running vulnerable versions of radare2 and avoid running radare2 with elevated privileges. Monitor for updates from radareorg regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-23T20:00:58.248Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69ea89bd87115cfb685d0b0f
Added to database: 4/23/2026, 9:06:05 PM
Last enriched: 4/23/2026, 9:21:32 PM
Last updated: 4/24/2026, 12:13:45 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.