JFrog Artifactory bug lets users write files outside cache
JFrog Artifactory, a tool companies use to store and manage their software builds, has a bug that lets a logged-in user write files outside the folder meant to hold cached Docker images. That can let someone plant or overwrite files in places on the server they should not be able to reach.
- Severity
- MediumCVSS 3.1 ยท 5.3
- Fix
- Update availableFix recorded on Sep 2, 2026
- Affected versions
- before 7.146.35; 7.161.0 to before 7.161.16
- Weakness
- CWE-22Path Traversal
- Exploit likelihood
- 0.58% in 30 daysEPSS, higher than 46% of known flaws
- Affects
- Artifactory
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Aug 27, 2026
- Federal fix deadline
- Sep 10, 2026
How it works
When Artifactory pulls and caches a Docker image from a connected remote repository under certain conditions, it does not fully keep the saved files inside the Docker cache folder, so a logged-in user can make it write data outside that folder.
What to do
There is no publicly listed affected version or build for this advisory, so check your Artifactory instance's version against JFrog's own security advisories and release notes to see if a fix applies to your build.
No exact patched version is public yet, so update Artifactory through JFrog's normal release channel and watch JFrog's official advisory page for the fix tied to this CVE.
Technical details
CVE-2026-66384 is a path traversal issue (CWE-22) in JFrog Artifactory. An authenticated user can cause Artifactory to write data outside the directory intended to hold cached Docker layers, but only under specific remote-repository conditions that are not detailed in the public record. CISA added it to the Known Exploited Vulnerabilities catalog with a high severity rating and an EPSS score near 0.3 percent. No proof-of-concept, exploited-in-the-wild details, or fixed version number are publicly documented as of this writing.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity High Attack depends on conditions outside the attacker's control
- Privileges required Low Attacker needs a basic user account
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact None No data disclosure
- Integrity impact High Protected data can be changed with serious impact
- Availability impact None No availability impact
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N Open in FIRST.org calculator