CVE-2026-6940

HighPublic PoC

Published: 23 April 2026

Published

23 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS Score 0.0002 6.3th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6940 is a high-severity Path Traversal (CWE-22) vulnerability in Radare Radare2. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Destruction (T1485); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Data Destruction (T1485). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by requiring timely patching to radare2 6.1.4 or later, which fixes the path traversal in project deletion.

SI-10 Information Input Validation good match

prevent

Requires validation of supplied project paths to ensure they do not escape the configured dir.projects root directory, preventing traversal attacks.

AC-6 Least Privilege partial match

prevent

Enforces least privilege on the radare2 process to limit the directories it can access and delete, reducing the integrity and availability impact of exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

Why these techniques?

Path traversal in project deletion directly enables recursive arbitrary directory deletion, mapping to data destruction with high integrity/availability impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker…

files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

Deeper analysisAI

CVE-2026-6940 is a path traversal vulnerability (CWE-22) affecting radare2 versions prior to 6.1.4, specifically in the project deletion functionality. The flaw enables attackers to supply absolute paths that escape the configured dir.projects root directory, leading to recursive deletion of arbitrary directories. This issue arises when attackers craft paths to project marker files outside the intended project storage boundary, exploiting the deletion mechanism to target attacker-chosen locations with the permissions of the radare2 process.

Local attackers can exploit this vulnerability with low complexity and no privileges required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, score 7.1), though it requires user interaction, such as convincing a user to delete a maliciously crafted project. Successful exploitation results in high integrity and availability impacts, allowing recursive deletion of directories, but no confidentiality loss.

Mitigation is available through a patch in radare2 pull request 25830 on GitHub, which addresses the path traversal in project deletion. VulnCheck has published an advisory detailing the vulnerability and recommending upgrade to radare2 6.1.4 or later to prevent arbitrary directory deletion.