Vulnerability · Published Apr 10, 2026 · Assigned by securin
CVE-2026-6057Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution
Critical 9.8
In plain English
A critical-severity path traversal in FalkorDB Browser from FalkorDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FalkorDB | FalkorDB Browser | 1.9.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H