CVE-2026-6057: FalkorDB Browser Unauthenticated Path Traversal RCE

Executive Summary

A critical unauthenticated remote code execution vulnerability (CVE-2026-6057) has been disclosed in FalkorDB Browser 1.9.3, the web-based management interface for the FalkorDB graph database. The vulnerability resides in the file upload API endpoint, which fails to validate or sanitize the user-supplied file path. An unauthenticated remote attacker can exploit this path traversal flaw to write arbitrary files to any location on the server filesystem, which can be chained into full remote code execution.

CVSS Score: 9.8 (Critical)

No authentication is required to exploit this vulnerability. Any attacker with network access to the FalkorDB Browser HTTP interface can trigger the file write primitive and escalate to code execution. Organizations running FalkorDB Browser in internet-accessible or shared-network environments should treat this as an emergency remediation priority.

Vulnerability Overview

Affected Products

Technical Analysis

Root Cause

The FalkorDB Browser file upload API endpoint accepts a user-supplied file path parameter without performing adequate sanitization or path normalization. The application fails to:

1. Validate that the target write path remains within an allowed directory
2. Strip path traversal sequences (../, ..\\, encoded variants such as %2e%2e%2f)
3. Enforce any authentication check before processing file upload requests

This creates a direct path traversal write primitive that is exploitable without any credentials.

Attack Flow

1. Attacker identifies a FalkorDB Browser instance on the network (default port 3000)
2. Attacker sends a crafted multipart POST request to the file upload API
3. The target path parameter contains path traversal sequences (e.g. ../../../../etc/cron.d/evil)
4. FalkorDB Browser writes attacker-controlled content to the resolved path
5. Attacker writes a web shell, cron job, or authorized_keys entry for persistence
6. Attacker triggers the written payload to achieve code execution under the server process

Exploitation Techniques

Depending on the server OS and configuration, common paths to code execution from arbitrary file write include:

• Cron job injection — write to /etc/cron.d/ or /var/spool/cron/ to execute commands on a schedule
• SSH authorized_keys — write to ~/.ssh/authorized_keys for the user running FalkorDB to gain shell access
• Web shell deployment — write an executable script to any web-accessible directory
• Service configuration tampering — overwrite startup scripts or systemd unit files to inject commands executed at service restart

Impact Assessment

Immediate Remediation

Step 1: Identify Exposed Instances

# Check if FalkorDB Browser is listening on a network-accessible interface
ss -tlnp | grep 3000
netstat -tlnp | grep 3000
 
# Confirm the process
ps aux | grep falkor

Step 2: Apply Emergency Network Restriction

If patching is not immediately possible, restrict access to FalkorDB Browser using firewall rules:

# Block all external access to FalkorDB Browser (adjust interface/port as needed)
iptables -I INPUT -p tcp --dport 3000 -j DROP
 
# Allow only trusted admin IPs
iptables -I INPUT -p tcp --dport 3000 -s <ADMIN_IP>/32 -j ACCEPT

For Docker-deployed instances:

# Bind FalkorDB Browser to loopback only — edit docker-compose.yml
# Change:  ports: - "3000:3000"
# To:      ports: - "127.0.0.1:3000:3000"
docker compose up -d falkordb-browser

Step 3: Upgrade to Patched Version

Monitor the FalkorDB GitHub releases and upgrade to the patched release as soon as it is available.

# Check current installed version
falkordb-browser --version
 
# Pull latest patched Docker image
docker pull falkordb/falkordb-browser:latest
docker compose pull && docker compose up -d

Step 4: Audit for Compromise Indicators

# Look for recently modified files in sensitive system directories
find /etc/cron.d /etc/cron.daily /var/spool/cron -newer /tmp/baseline -type f 2>/dev/null
 
# Check for unauthorized SSH keys
cat /root/.ssh/authorized_keys
find /home -name authorized_keys -exec cat {} \;
 
# Review web-accessible directories for unexpected scripts
find /var/www /opt/falkordb -name "*.php" -o -name "*.sh" -newer /tmp/baseline 2>/dev/null

Detection Indicators

Post-Remediation Checklist

1. Patch all FalkorDB Browser instances immediately upon release availability
2. Restrict network access — FalkorDB Browser should never be internet-exposed; use a VPN or bastion host
3. Audit filesystem for attacker-planted files, cron jobs, and unauthorized SSH keys
4. Rotate credentials stored within or accessible from the FalkorDB host
5. Review process logs for anomalous subprocess execution by the FalkorDB service user
6. Enable file integrity monitoring on sensitive directories using tools like AIDE or auditd
7. Run FalkorDB as a low-privilege user with no write access outside its data directory
8. Notify security operations if exploitation indicators are found — treat as a full incident

References

• NVD — CVE-2026-6057
• FalkorDB GitHub Repository