CVE-2026-6057 - Vulnerability Details - OpenCVE

FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Falkordb	Falkordb Browser

No data.

No data.

References

Link	Providers
https://github.com/FalkorDB/falkordb-browser
https://github.com/FalkorDB/falkordb-browser/pull/1611

History

Fri, 10 Apr 2026 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 10 Apr 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Falkordb Falkordb falkordb Browser
Vendors & Products		Falkordb Falkordb falkordb Browser

Fri, 10 Apr 2026 09:45:00 +0000

Type	Values Removed	Values Added
Description		FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.
Title		Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution
Weaknesses		CWE-22
References		https://github.com/FalkorDB/falkordb-browser https://github.com/FalkorDB/falkordb-browser/pull/1611

MITRE

Status: PUBLISHED

Assigner: securin

Published: 2026-04-10T09:16:30.338Z

Updated: 2026-04-10T20:25:53.551Z

Reserved: 2026-04-10T00:33:01.535Z

Link: CVE-2026-6057

Vulnrichment

Updated: 2026-04-10T20:25:10.352Z

NVD

Status : Received

Published: 2026-04-10T10:16:04.547

Modified: 2026-04-10T21:16:28.800

Link: CVE-2026-6057

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6057", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-04-10T00:33:01.535Z", "datePublished": "2026-04-10T09:16:30.338Z", "dateUpdated": "2026-04-10T20:25:53.551Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-04-10T09:16:30.338Z"}, "title": "Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Path Traversal", "type": "CWE"}]}], "affected": [{"vendor": "FalkorDB", "product": "FalkorDB Browser", "platforms": ["Linux", "64 bit", "Windows"], "versions": [{"status": "affected", "version": "1.9.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.</p>"}]}], "references": [{"url": "https://github.com/FalkorDB/falkordb-browser"}, {"url": "https://github.com/FalkorDB/falkordb-browser/pull/1611"}], "credits": [{"lang": "en", "value": "Ramesh Gunnam from Securin", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T20:24:59.231118Z", "id": "CVE-2026-6057", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T20:25:53.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-6057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-10T20:24:59.231118Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T20:25:10.352Z"}}], "cna": {"title": "Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ramesh Gunnam from Securin"}], "affected": [{"vendor": "FalkorDB", "product": "FalkorDB Browser", "versions": [{"status": "affected", "version": "1.9.3"}], "platforms": ["Linux", "64 bit", "Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/FalkorDB/falkordb-browser"}, {"url": "https://github.com/FalkorDB/falkordb-browser/pull/1611"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.", "supportingMedia": [{"type": "text/html", "value": "<p>FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-04-10T09:16:30.338Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6057", "state": "PUBLISHED", "dateUpdated": "2026-04-10T20:25:53.551Z", "dateReserved": "2026-04-10T00:33:01.535Z", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "datePublished": "2026-04-10T09:16:30.338Z", "assignerShortName": "securin"}, "dataVersion": "5.2"}