JFrog Artifactory CVE-2026-65921

The attacker must possess valid low-privilege credentials for the JFrog Artifactory application (PR:L). The instance must be configured to accept archive uploads for build artifacts, which is a standard feature. No user interaction is required beyond the initial upload, and the traversal can be triggered remotely over the network. No special deployment mode or additional features need to be enabled beyond the default artifact management functionality.

CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a remote, low-complexity attack requiring low privileges and no user interaction, resulting in full confidentiality, integrity, and availability impact. However, ESPS exploitation probability data is not available, and the vulnerability is not listed in CISA KEV. The prerequisite of authenticated access (even low-privileged) significantly limits the attack surface compared to unauthenticated remote flaws; an attacker must first obtain valid credentials. No proof-of-concept code or active exploitation has been reported, suggesting the immediate real-world risk is lower than the base CVSS score alone might imply. The risk is moderate for organizations running unpatched Artifactory instances, especially those where low-level credentials could be obtained via other means. The absence of a confirmed fix version in the provided data adds uncertainty.

An attacker with low-privilege credentials to an Artifactory instance uploads a crafted archive containing files with path traversal sequences (e.g., ../../bin/evil.dll). When the server extracts the archive to the build artifacts directory, the malicious entry is written to an arbitrary location, overwriting a system binary or configuration file, leading to remote code execution.