JFrog Artifactory CVE-2026-66384

Exploitation requires a valid Artifactory user account with at least low-privilege access (confirmed by CVSS PR:L). Additionally, the description explicitly states that 'specific remote-repository conditions' must be present - meaning a remote Docker repository must be configured in Artifactory in a particular way that exposes the vulnerable code path; this is not a default-configuration risk and is consistent with the CVSS AC:H rating. Artifactory instances with no remote Docker repositories configured are not exposed to this vulnerability. The absence of user interaction (UI:N) means the attacker does not need to trick another user once conditions are met. Exploitation is limited by: required authenticated access (no unauthenticated path per PR:L), non-default remote-repository configuration (AC:H), and network reachability to the Artifactory instance.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) at 5.3 Medium encodes a genuine but conditioned risk: the High integrity impact reflects the ability to write to arbitrary filesystem paths, but AC:H acknowledges that specific remote-repository conditions must be present - this is not a default-configuration exposure. PR:L confirms that a valid authenticated account is required, ruling out unauthenticated mass exploitation. No EPSS score was provided in the input data, which limits probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, meaning real-world exploitation has not been observed or confirmed. Path traversal primitives that enable arbitrary file writes carry non-trivial chaining potential - an attacker who can write to sensitive directories (e.g., application config, cron directories, or SSH authorized_keys) may escalate impact well beyond what the CVSS base score alone suggests. Defenders should not dismiss this as low-priority solely due to the medium score; the I:H rating combined with network accessibility warrants prompt patching, particularly in environments where Artifactory runs with elevated OS-level permissions.

An attacker holding a low-privilege Artifactory account identifies an instance configured with a remote Docker repository under specific conditions that trigger the path traversal. The attacker submits a crafted authenticated request embedding traversal sequences in the Docker cache path parameter, causing Artifactory to write attacker-controlled content to an arbitrary location on the server filesystem outside the cache boundary - potentially targeting application configuration files, startup scripts, or other writable paths accessible to the Artifactory process. No public proof-of-concept exploit has been identified at time of analysis.