CVE-2026-6941

🔶 medium

Summary

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.

CVSS Score

6.6

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-04-23

First Seen: 2026-04-27

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 48.0% of all 329,456 vulnerabilities in our database.

#171,268

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 24, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Chia Min Jun Lennon

SSVC data provided by CISA

Last Modified 2026-04-27

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

CVSS Vector 4.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-59 CWE-22

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
radare	radare2	Affected	< 6.1.4

🔗 References 3

https://github.com/radareorg/radare2/commit/4bcdee72...

Patch

https://github.com/radareorg/radare2/pull/25831

Exploit Issue Tracking Third Party Advisory

https://www.vulncheck.com/advisories/radare2-project...

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-8695	⚠️ high	7.5	0.4	radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers t...	2026-05-15
CVE-2026-8696	⚠️ high	7.5	0.4	radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that a...	2026-05-15
CVE-2026-6940	⚠️ high	7.1	0.0	radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recurs...	2026-04-23
CVE-2026-40517	⚠️ high	7.8	0.0	radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows...	2026-04-22
CVE-2026-40527	⚠️ high	7.8	0.1	radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ...	2026-04-17
CVE-2026-40499	⚠️ high	7.8	0.0	radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function tha...	2026-04-15

These CVEs affect the same products