PT-2026-34751 · Radware+2 · Radare2

Hinotoi-Agent · Published 2026-04-23 · Updated 2026-04-24 · CVE-2026-6940

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.1.4

Description A path traversal issue in project deletion allows local attackers to recursively delete arbitrary directories. By supplying absolute paths that escape the configured dir.projects root directory, attackers can target project marker files outside the project storage boundary. This action results in the recursive deletion of chosen directories using the permissions of the radare2 process, leading to loss of integrity and availability.

Recommendations Update to version 6.1.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6940

Affected Products

Radare2

References · 8

• 🔥 https://github.com/radareorg/radare2/pull/25830 · Exploit
• https://github.com/radareorg/radare2/pull/25830/commits · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6940 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6940 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6940 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6940 · Security Note
• https://github.com/radareorg/radare2/commit/e5fcf56fe038760c872c6dbed432602778fde1ed · Note
• https://vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-deletion · Note