Critical · 9.8 CVE-2026-6057 EUVD-2026-21358GHSA-2987-f6gf-82vj

Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution

Published Apr 10, 2026 · Updated Apr 10, 2026 · Assigned by securin

Vendor: FalkorDB Product: FalkorDB Browser

Description

FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.

Affected products

Vendor	Product	Affected	Fixed
FalkorDB	FalkorDB Browser	1.9.3	—

References

https://github.com/FalkorDB/falkordb-browser
https://github.com/FalkorDB/falkordb-browser/pull/1611