CVE-2026-6057: FalkorDB Browser unauthenticated path traversal in file upload API
FalkorDB Browser 1.9.3 is reported to contain an unauthenticated path traversal flaw in its file upload API, which the record says lets remote attackers write arbitrary files and achieve remote code execution. The recorded CVSS 3.1 base score is 9.8 (Critical). No confirmed exploitation appears in the sources consulted, and the record lists no affected version ranges or fixes.
Overview
FalkorDB Browser 1.9.3 is reported to contain an unauthenticated path traversal vulnerability in its file upload API, classified under CWE-22 (Path Traversal). The record describes remote attackers writing arbitrary files and achieving remote code execution.
Impact
- According to the record, the flaw allows arbitrary file writes and remote code execution.
- The recorded CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network reachability, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- The recorded base score is 9.8, rated Critical.
Affected products and versions
- The description names FalkorDB Browser 1.9.3.
- The record contains no structured list of affected versions, so the full range of impacted versions is unknown.
- The record lists no fixed versions. This does not mean no fix exists. The reference list includes a pull request in the FalkorDB Browser repository, whose content the record does not describe: FalkorDB Browser pull request 1611.
Exploitation status
- According to the record, the vulnerability is not listed in the CISA KEV catalog.
- No confirmed exploitation appears in the sources consulted.
- The EPSS probability is 0.01159 with a percentile of 0.66268, recorded with a date of 2026-10-13. EPSS estimates the likelihood of exploitation activity and does not confirm exploitation.
Remediation and mitigation
- Identify all FalkorDB Browser deployments and confirm whether version 1.9.3 or another potentially affected version is in use.
- Check the project repository and release notes for an updated version that addresses this issue, and apply it after validation.
- Until a validated fix is in place, restrict network access to the Browser interface, place it behind authentication controls at the network layer, and avoid exposing the file upload functionality to untrusted networks.
- Run the service with least privilege and restrict write permissions on the file system where feasible, to limit the impact of unauthorized writes.
Detection guidance
- Review web server and application logs for unexpected upload requests, especially from unknown sources, and for uploaded files with unusual names or locations.
- Monitor the file system for newly created or modified files outside expected application directories.
- Watch for unexpected child processes or unusual outbound connections from the Browser host.
Limitations of the available information
- The record does not state the affected version range, the fixed version, or the technical scope of the upload endpoint.
- The record does not state whether the referenced pull request fixes this issue.
- The CVSS source and the EPSS date are reported as recorded and were not independently verified.
- The record carries a source status of Deferred.
Frequently asked questions
Is CVE-2026-6057 known to be actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS value is an estimate, not a confirmation of exploitation.
Which versions are fixed?
The record lists no fixed versions. It does list a pull request in the FalkorDB Browser repository, but the record does not say whether that change fixes this issue, so the fix status should be verified with the project.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.