EUVD-2026-25301
GHSA-x2x5-gj4j-p6qw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector only; no privileges required to run radare2; user must perform deletion action (UI:R); purely destructive with no confidentiality impact and unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.
AnalysisAI
Path traversal in radare2's project deletion function (r_core_project_delete in libr/core/project.c) allows a local attacker to cause recursive deletion of arbitrary directories by supplying crafted absolute project paths that escape the configured dir.projects root. All versions prior to 6.1.4 are affected. An attacker who controls a project file path can cause radare2 - running with the victim's permissions - to wipe arbitrary directories, resulting in significant integrity and availability impact. No public exploit identified at time of analysis for weaponized in-the-wild use; however, a publicly available exploit (POC) exists via the upstream GitHub PR, and SSVC rates technical impact as total despite non-automatable exploitation.
Technical ContextAI
radare2 is a widely-used open-source reverse engineering framework (CPE: cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*). The vulnerability is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw in the project management subsystem. The root cause is the absence of a boundary check in r_core_project_delete: before the fix, the function called r_file_abspath() to resolve the supplied project path but never verified that the resolved path resided within the dir.projects root. The patch (PR #25830) introduces project_path_is_within_projects_dir(), which resolves both dir.projects and the target path to absolute forms, appends the platform path separator, and uses r_str_startswith() to confirm containment before any deletion proceeds. The diff also adds regression tests for both the rejection case (absolute path outside dir.projects) and the acceptance case (absolute path inside dir.projects).
RemediationAI
Upgrade to radare2 6.1.4 or later, which introduces the project_path_is_within_projects_dir() boundary check in libr/core/project.c; the upstream fix is in GitHub PR #25830 (https://github.com/radareorg/radare2/pull/25830). If upgrading immediately is not possible, the primary workaround is to avoid loading or deleting any radare2 project files from untrusted sources - never run the P- command against project files supplied by third parties or found in shared or writable directories. On multi-user systems where radare2 is available to multiple accounts, restrict the tool to trusted users via filesystem permissions or sudo policy to limit who can trigger project deletion. Note that restricting dir.projects via configuration alone is insufficient as a workaround, since the vulnerability exists precisely because that boundary is not enforced in vulnerable versions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today