FalkorDB Browser 1.9.3 contains an unauthenticated path traversal flaw in its file upload API, allowing an attacker to write arbitrary files to the server’s file system and thereby execute code remotely. The vulnerability is a classic example of the "Path Traversal" weakness (CWE‑22). The impact is the complete compromise of confidentiality, integrity, and availability by enabling arbitrary code execution on the host running FalkorDB Browser.

The flaw affects FalkorDB Browser version 1.9.3, as supplied by FalkorDB. No other versions or additional products were listed, so only installations of this exact version are susceptible.

With a CVSS score of 9.8 the issue is considered Critical. The EPSS score is below 1%, indicating low expected exploitation frequency, and it is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the file upload endpoint, exploiting directory traversal to write a malicious file that can then be executed. The requirement for authentication is absent, so any network‑reachable user can trigger the flaw if the API is exposed.