The vulnerability CVE-2026-6941 in radare2 (before 6.1.4) involves improper link resolution (CWE-59) during project notes handling. When importing a .zrp archive, an attacker can include a symlinked notes.txt file that circumvents directory confinement checks, allowing file operations to access arbitrary files outside the configured project directory. This path traversal flaw can lead to unauthorized file read or write operations. The CVSS 4.0 base score is 6.9 (medium), reflecting local attack vector, low complexity, no privileges required, but requiring user interaction and with limited confidentiality and high integrity impact. No patch or official remediation guidance is currently available.

Successful exploitation allows an attacker with local access and user interaction to read or write files outside the intended project directory in radare2. This can compromise file integrity and confidentiality within the affected system. The impact is limited by the need for local access and user interaction, and no known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid importing untrusted .zrp archives containing project notes and be cautious with files that may contain symbolic links. Monitor vendor communications for updates on patches or official mitigations.