JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384) Security Advisory: Arbitrary File Write via Docker Cache Path

Affected Vendors

jfrog

Affected Components

artifactory

Published Date

2026-08-12

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

JFrog Artifactory Self-Managed instances under specific remote-repository conditions

Impact

An authenticated attacker can write data outside the intended Docker cache path, potentially compromising system integrity

Mitigation

Immediately upgrade JFrog Artifactory to the latest patched version and restrict untrusted remote repository configurations

Affected Products & Version Scope

JFrog Artifactory Self-Managed versions with specific remote repository caching enabled

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch Application

Refer to the JFrog Release Notes and upgrade your Artifactory instance to the latest secure version immediately.

2. Temporary Mitigations

If immediate patching is not feasible, implement the following workarounds:

Restrict Remote Repositories: Limit the creation and synchronization of untrusted external remote repositories.
Enforce Least Privilege: Audit and restrict user permissions related to Docker repository configuration and cache management.
WAF & Monitoring: Configure Web Application Firewall (WAF) rules to detect and block suspicious Docker API requests containing path traversal sequences (e.g., ../).

Recommended Security Control & Mitigation Partner

Snyk Open Source & Container Security

Due to active exploitation confirmed by CISA KEV, immediately upgrade your JFrog Artifactory to the latest secure release.

Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds

Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.

Free Forever Tier · 1-Click GitHub/GitLab Auto-PR

Scan Your Git Repositories for Free

Master DevSecOps: Automated SAST/SCA in GitHub Actions & Kubernetes

View Course Curriculum

Technical Root Cause & Exploitation Mechanics

CVE-2026-66384 is a Path Traversal vulnerability (CWE-22) residing in the Docker remote repository caching mechanism of JFrog Artifactory.

Under specific remote-repository conditions, an authenticated user can exploit insufficient input validation to write data outside the designated Docker cache directory. Although assigned a CVSS score of 5.3 (Medium), this vulnerability is highly critical as it is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and exhibits an EPSS score of 0.94, indicating active wild exploitation. Attackers can leverage this to overwrite system files or disrupt application integrity.