---
id: CVE-2026-6940
title: radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
summary: >-
  radare2 prior to 6.1.4 contains a path traversal vulnerability in project
  deletion that allows local attackers to recursively delete arbitrary
  directories by supplying absolute paths that escape the configured
  dir.projects root directory…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: radareorg
product: radare2
affected:
  - radare2 < 6.1.4
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-24T13:38:04.696176Z'
exploitAvailable: true
published: '2026-04-23'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:08:24.553Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-6940'
references:
  - url: 'https://github.com/radareorg/radare2/pull/25830'
    label: Pull Request
  - url: 'https://github.com/radareorg/radare2/pull/25830/commits'
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/radare2-project-deletion-path-traversal-directory-deletion
tags:
  - cve.org
  - exploit-available
epss: 0.00218
epssPercentile: 0.1232
ingestedAt: '2026-11-08T14:51:22.262Z'
---

## Overview

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

## Affected

- `radare2 < 6.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.