JFrog Artifactory path traversal (CVE-2026-66384) — writing outside the software warehouse
JFrog Artifactory, widely used as a warehouse for software components, contains a flaw that allows escaping a restricted directory: under specific remote-repository conditions, an authenticated user can write data outside the intended Docker cache path. CISA added it to the KEV catalog on 2026-08-27 with a due date of 2026-09-10.
Key facts
- CVE IDCVE-2026-66384
- Affected (vendor / product)JFrog Artifactory
- CWECWE-22
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-09-10 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is JFrog Artifactory; the name is "Improper Limitation of a Pathname to a Restricted Directory Vulnerability" (path traversal).
- Under specific remote-repository conditions, an authenticated user can write data outside the intended Docker cache path.
- An artifact repository gathers and distributes the components internal builds consume, so contamination spreads one-to-many.
- Added to KEV 2026-08-27 with a due date of 2026-09-10 — fourteen days.
- Entries on this site added around the same time carry three-day dates; KEV deadlines are not uniform.
- A write into an artifact repository is pulled automatically into many later builds, spreading one to many.
1The shape of a path traversal flaw
Path traversal is a flaw in the logic that decides where a file is written or read from: the supplied path is checked inadequately, so it becomes possible to step outside the intended area. It typically shows up as parent-directory notation such as ".." taking effect. On a read it exposes files that should not be visible; on a write it places files where they should not go. What the catalog describes here is the latter — a write.
2What happens when the warehouse is contaminated
An artifact repository like Artifactory is the place where the components internal builds consume — libraries, container images, packages — are gathered and distributed. Whatever sits there is drawn into many subsequent builds automatically. If a write into the repository succeeds, the effect therefore does not stay inside the repository; it can spread to everything served from it.
That one-to-many structure is why artifact repositories carry so much weight in software supply chain discussions.
3The condition of an "authenticated user"
The catalog puts the actor as an authenticated user. Having to get through authentication makes the precondition heavier than for an unauthenticated flaw. On the other hand, an artifact repository is a place where developers, build servers, and automation tools authenticate routinely, so valid credentials exist widely inside an organization. How heavy that precondition really is depends on how well those credentials are governed.
4It does not end inside the repository
An artifact repository such as Artifactory is where the components internal builds reference are gathered and distributed. The impact of a successful write follows that one-to-many structure.
The catalog states the actor as an authenticated user. Needing to pass authentication makes the premise heavier than an unauthenticated flaw. On the other hand, an artifact repository is where developers, build servers and automation authenticate daily, so authenticated credentials exist widely inside an organisation. How heavy the premise is depends on how well those credentials are managed.
Why it matters
An artifact repository sits at the center of the build process, so downtime is hard to schedule and remediation slips. Yet contamination reaches every build served by it. Prioritization is more realistic when based on what is distributed from a system rather than on how many people use it. Taking inventory of which credentials hold write permission is the companion step for weighing how heavy the precondition really is.
FAQ
What is path traversal?
Why is a flaw in an artifact repository serious?
Is it less severe because authentication is required?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).