CVE-2026-6057

Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution

CVSS 9.8 CRITICALEPSS 0.9%CWE-22

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 abr 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

FalkorDB · FalkorDB Browser

Referencias

https://github.com/FalkorDB/falkordb-browser https://github.com/FalkorDB/falkordb-browser/pull/1611