Dashboard / CVE-2026-6940

CVE-2026-6940

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-04-23 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: None
VI: High
VA: High

Description

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
radare radare2 < 6.1.4

References & Advisories (3)

https://github.com/radareorg/radare2/pull/25830
Exploit Issue Tracking Third Party Advisory

Bug Bounty Relevance

39 / 100
✓ No authentication
✓ Low complexity

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.22%
Raw Score 0.002180
Percentile 12.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00218
2026-10-28
0.00218

Intelligence Sources

nvd ref →

External Links