PT-2026-34752 · Radareorg · Radare2

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-6941

NVD

CVSS v3.1

6.6

Medium

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-6941

Affected Products

Radare2

References · 4

• 🔥 https://github.com/radareorg/radare2/pull/25831 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6941 · Security Note
• https://vulncheck.com/advisories/radare2-project-notes-path-traversal-via-symlink · Note
• https://github.com/radareorg/radare2/commit/4bcdee725ff0754ed721a98789c0af371c5f32a4 · Note