EUVD-2026-57251
GHSA-p5w8-5mcx-xjqc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Raising AC to H reflects the vendor-stated 'specific conditions' prerequisite; all other metrics align with the provided vector.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
AnalysisAI
Path traversal in JFrog Artifactory permits authenticated low-privilege users to write files outside the intended working directory under specific conditions. Reported directly by JFrog, this CWE-22 flaw carries a CVSS 3.1 score of 4.3 (Medium), reflecting network reachability with limited integrity impact and no confidentiality or availability exposure. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Technical ContextAI
JFrog Artifactory is a universal binary repository manager widely deployed in enterprise DevOps pipelines to manage build artifacts across languages and package formats. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), in which user-controlled input is used to construct filesystem paths without sufficient canonicalization or boundary enforcement, enabling directory escape. The affected CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* uses a wildcard version, suggesting the vendor has not publicly scoped the vulnerable version range through NVD CPE alone - exact affected versions should be confirmed via the JFrog advisory at docs.jfrog.com/releases/docs/jfrog-security-advisories.
RemediationAI
Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases to identify the exact patched version and apply the vendor-released upgrade. An exact fix version has not been independently confirmed from the data provided - do not infer a version number from this analysis. As a compensating control pending patching, restrict Artifactory write permissions to the minimum set of authenticated roles that require them, review and tighten role-based access controls to limit which users can invoke the affected file-write operations, and monitor Artifactory logs for anomalous file paths in write requests that include traversal sequences such as '../'. Note that access restriction mitigates exposure but does not eliminate the underlying vulnerability if any low-privilege user role retains write access.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today