PatchTheCVECVE-2026-6940: radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers
CVE-2026-6940 is a high-severity flaw (CVSS 7.1) affecting radare2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in in
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-04-23 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-6940?
radare2: upgrade to 6.1.4. Exact commands for each OS are on this page.
Is CVE-2026-6940 being exploited?
CVE-2026-6940 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-6940 affect?
CVE-2026-6940 affects radare2. Severity is high (CVSS 7.1). radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. A
How urgent is CVE-2026-6940?
Priority 33/100. High severity; Public exploit reference
Related CVEs
- CVE-2026-40527 HIGH 7.8 UPGRADE radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path wher
- CVE-2026-40499 HIGH 7.8 UPGRADE radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() fu
- CVE-2026-40517 HIGH 7.8 UPGRADE radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function t
- CVE-2026-6941 MEDIUM 6.6 UPGRADE radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attac
- CVE-2026-14757 MEDIUM 5.3 UPGRADE A vulnerability was determined in radareorg radare2 up to 6.1.6