EUVD-2026-49569
GHSA-9567-xfjr-xvwf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege remote attacker can easily exploit path traversal to write arbitrary files, achieving full compromise.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.
AnalysisAI
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Technical ContextAI
The vulnerability resides in the server-side handling of archive files (e.g., ZIP, TAR) during extraction/write operations. The product fails to properly validate file paths embedded within the archive, permitting sequences such as '../' to escape the sandboxed build artifacts directory (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The affected product is JFrog Artifactory, as indicated by the CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, which covers all self-managed versions. The flaw is classic path traversal in the context of artifact uploads, where the software trusts archive entry names without sufficient sanitization.
RemediationAI
Upgrade to a patched version of JFrog Artifactory as detailed in the vendor's security advisory. The advisory and release notes are available at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases; consult them for the exact fixed release. If immediate patching is not possible, restrict upload permissions to trusted users, and validate or sanitize archive content before extraction using application-aware inspection. Consider network-level restrictions to limit access to the Artifactory instance to only essential networks. Note that applying restrictive upload policies may hinder legitimate artifact management workflows.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today