Radare2 Path Traversal Flaw: Local Attackers Can Delete Arbitrary Directories

The National Vulnerability Database has disclosed CVE-2026-6940, a critical path traversal vulnerability affecting radare2 versions prior to 6.1.4. This flaw allows local attackers with UI interaction to recursively delete arbitrary directories by manipulating project deletion. By crafting absolute paths that escape the intended project directory, an attacker can cause the tool to delete directories outside its scope, leveraging the permissions of the running radare2 process.

This vulnerability, classified as HIGH severity with a CVSS score of 7.1, presents a significant risk to system integrity and availability. While affected products beyond the radare2 tool itself are not specified, any environment utilizing this reverse engineering framework could be at risk. The CWE-22 classification highlights the classic directory traversal nature of the exploit, where input validation failures lead to unintended file system access.