CVE-2026-6941 is a path traversal vulnerability in radare2 prior to version 6.1.4 affecting the project notes feature. Attackers can craft a .zrp archive with a symlinked notes.txt file that circumvents directory confinement checks, enabling read or write access to arbitrary files outside the configured project directory. This improper link resolution before file access (CWE-59) can lead to unauthorized file system access. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

Successful exploitation allows an attacker to read or write files outside the intended project directory by leveraging a crafted .zrp archive with a symlinked notes.txt. This can lead to unauthorized file system access and potential data exposure or modification. The vulnerability does not require privileges but does require user interaction (importing the malicious archive). No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid importing .zrp archives from untrusted sources to prevent exploitation of this path traversal vulnerability.