EUVD-2026-57250
GHSA-4m9c-v4gj-j8h4
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:N reflects network-accessible API; PR:L requires authenticated cache-deploy permission; AC:H reflects undisclosed specific conditions; C:H for cross-boundary read; I:N and A:N as no write or disruption impact.
Primary rating from Vendor (JFROG).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
AnalysisAI
Path traversal in JFrog Artifactory exposes arbitrary repository content to low-privileged users holding the cache-deploy permission under specific, unspecified triggering conditions. An authenticated repository reader with cache-deploy rights can read artifacts outside the configured upstream path boundary, potentially accessing sensitive build artifacts, credentials embedded in packages, or proprietary code across repository namespaces they should not reach. No public exploit code exists and no CISA KEV listing is present, but the CVSS confidentiality impact is rated High, making this significant in multi-tenant or shared Artifactory deployments.
Technical ContextAI
JFrog Artifactory (CPE: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*) is a universal artifact repository manager widely used in enterprise CI/CD pipelines. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Path Traversal). The cache-deploy permission is a specific Artifactory role that allows a user to cache and deploy artifacts through a remote or virtual repository - distinct from full deploy rights. The flaw arises when path validation logic inadequately constrains the filesystem or repository path resolution during cache operations, allowing a crafted request to escape the upstream path boundary configured for that repository. The AC:H vector component reflects that specific triggering conditions (likely a particular request pattern, repository configuration, or race condition) must be met for the traversal to succeed.
RemediationAI
Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and upgrade to the patched Artifactory version identified there - no exact fix version was confirmed in the available input data, so check the release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases directly. Upstream fix committed but released patched version not independently confirmed from available data. As a compensating control, review and minimize cache-deploy permission grants: restrict this permission to only users and service accounts that operationally require it, applying least-privilege principles. Audit repository permission matrices in the Artifactory admin console to identify over-permissioned users. Consider separating sensitive artifact repositories from those accessible by broader user populations. Network-level restriction of the Artifactory API to trusted CI/CD network segments limits the attack surface but does not eliminate the vulnerability for internal threat actors. Rotating any secrets stored as artifacts in affected repositories should be evaluated as a precaution if the vulnerability was present and exploitation cannot be ruled out.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today