Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-6941 is a medium-severity Link Following (CWE-59) vulnerability in Radare Radare2. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-6941 is a path traversal vulnerability (CWE-59, CWE-22) in radare2 versions prior to 6.1.4, specifically in the project notes handling feature. The flaw arises when importing a malicious .zrp archive containing a symlinked notes.txt file, which bypasses directory confinement checks in the dir.projects root directory. This allows note operations to follow the symlink, enabling read or write access to arbitrary files outside the configured project directory.
The vulnerability can be exploited by a local attacker with no privileges required (PR:N), though it demands low-complexity actions (AC:L) and user interaction (UI:R) to convince a victim to import the crafted .zrp archive. Successful exploitation yields low confidentiality impact (C:L), high integrity impact (I:H), and low availability impact (A:L), resulting in a CVSS v3.1 base score of 6.6. Attackers can thereby read sensitive files or overwrite arbitrary files outside the project scope.
Mitigation is addressed in radare2 version 6.1.4 and later via patches detailed in the fixing commit at https://github.com/radareorg/radare2/commit/4bcdee725ff0754ed721a98789c0af371c5f32a4 and pull request https://github.com/radareorg/radare2/pull/25831. Further analysis is provided in the VulnCheck advisory at https://www.vulncheck.com/advisories/radare2-project-notes-path-traversal-via-symlink.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25302
Vulnerability Data
radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can…
more
craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V15.4.2
Mitigating Controls (NIST 800-53 r5) AI
Proper enforcement of access authorizations on the resolved target resource stops a link from reaching an unintended object.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least-privilege limits the damage an attacker can cause after following an unintended link.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code to validate paths and avoid unsafe link following.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect link-following flaws before release.
Secure SDLC practices can mandate link-resolution checks and canonicalization before file access.
Application security requirements can explicitly require safe handling of symbolic links and path traversal.
Secure architecture principles include input validation and safe file-access design patterns.
Secure coding standards directly address canonicalization and symlink attacks during implementation.
Information access restriction limits which files an application may read or write.