CVE-2026-6941

MEDIUM 6.6

radare2 < 6.1.4 Project Notes Path Traversal via Symlink

CVSS Score

6.6

EPSS Score

0.0%

EPSS Percentile

0th

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.

CWE	CWE-59
Vendor	radareorg
Product	radare2
Published	Apr 23, 2026

Stay Ahead of the Next One

Get instant alerts for radareorg radare2

Be the first to know when new medium vulnerabilities affecting radareorg radare2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Affected Versions

radareorg / radare2

0 < 6.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/radareorg/radare2/pull/25831 github.com: https://github.com/radareorg/radare2/commit/4bcdee725ff0754ed721a98789c0af371c5f32a4 vulncheck.com: https://www.vulncheck.com/advisories/radare2-project-notes-path-traversal-via-symlink

Credits

Chia Min Jun Lennon