A path traversal vulnerability in radare2, affecting versions prior to 6.1.4, allows local attackers to cause unauthorized directory deletion, leading to significant system integrity and availability loss.

The flaw is a path traversal (CWE-22) issue within the project deletion functionality. An attacker can supply absolute paths to escape the restricted project directory, allowing the application to delete arbitrary directories on the filesystem with the permissions of the radare2 process.

Successful exploitation results in the recursive deletion of arbitrary directories, which poses a severe threat to system availability and data integrity. Given the CVSS score of 7.1, this vulnerability is classified as High severity, as it can lead to the destruction of critical system files or project data, causing significant operational disruption.

Immediate Action: Upgrade to the latest version of radare2 (6.1.4 or later) to ensure the path traversal check is correctly implemented.

Proactive Monitoring: Monitor filesystem activity and audit logs for unexpected recursive deletion commands or attempts to access directories outside of the designated project workspace.

Compensating Controls: Ensure that the radare2 process runs with the principle of least privilege, specifically limiting write and delete permissions to only those directories strictly required for its operation.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a clear risk to system integrity through unauthorized file system operations. IT administrators should prioritize updating radare2 to version 6.1.4 or higher across all deployments to eliminate the path traversal vector. Until patching is completed, ensure that the application is executed in a restricted environment to prevent unauthorized access to sensitive system directories.