Executive brief
JFrog Artifactory is a widely-used artifact repository manager used by software development teams to store and manage dependencies. This vulnerability allows an authenticated user to bypass directory restrictions and write files outside the intended cache location, potentially leading to unauthorized code execution, data manipulation, or system compromise. The issue affects Artifactory instances configured with specific remote repository settings.
Technical details
This is a path traversal (improper pathname limitation) vulnerability in JFrog Artifactory's Docker cache handling mechanism. The vulnerability requires an authenticated user account but allows writing data outside the restricted Docker cache directory under specific remote repository configurations. An authenticated attacker can craft requests that traverse the directory restrictions using relative paths or path traversal sequences, enabling placement of arbitrary files on the file system. This could lead to remote code execution if writable directories in the application path are exploited. The vulnerability has been observed in active exploitation in the wild as of the publication date.
Affected products
- JFrog Artifactory
Timeline
- 2026-08-27: disclosed
- 2026-08-27: exploited