Exploited vulnerability

CVE-2026-66384

TLP:CLEAR

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

Facts

Vendor: JFrog
Product: Artifactory
CVSS: 5.3
EPSS (probability of exploitation within 30 days): 0.7 %
On CISA's Known Exploited Vulnerabilities list since: 27 August 2026
First known exploitation: 27 August 2026
CISA's deadline for US federal agencies: 10 September 2026
Weakness: CWE-22
First seen by Risk Letters: 27 August 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD