CVE-2026-6057 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-6057 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6057 is an unauthenticated path traversal vulnerability in the file upload API of FalkorDB Browser version 1.9.3, a web-based interface for the FalkorDB graph database, that allows remote attackers to write arbitrary files to the underlying server.

Technical Detail

The flaw exists in the file upload API endpoint, which fails to properly sanitize or restrict user-supplied file path components, enabling an unauthenticated remote attacker to traverse directory boundaries and write attacker-controlled content to arbitrary locations on the filesystem. By placing a malicious file in a web-accessible directory or overwriting a server-side script or configuration file, an attacker can achieve remote code execution without any prior authentication. The combination of no authentication requirement and direct write access to the filesystem results in a CVSS score of 9.8, reflecting the full impact of confidentiality, integrity, and availability compromise.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning active in-the-wild exploitation has not been confirmed. However, the unauthenticated nature of the vulnerability and the straightforward attack mechanism lower the barrier for independent exploitation development.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability as of April 17, 2026.

What To Do

Organizations running FalkorDB Browser 1.9.3 should treat this as a high-priority patching item given the critical CVSS score and the unauthenticated attack vector. Check the FalkorDB project repository and official release channels for a patched version and apply it immediately upon availability. As an interim workaround, restrict network access to the FalkorDB Browser interface using firewall rules or reverse proxy controls so that only trusted IP ranges can reach the file upload API endpoint. If the service does not need to be internet-facing, take it offline or bind it to localhost until a patch is applied. Detection efforts should focus on anomalous file creation events in web root or application directories, unexpected process spawning from the FalkorDB Browser process, and unusual HTTP POST requests to the file upload API endpoint originating from untrusted sources.