CVE-2026-66384KEV · OVERDUECWE-22path-traversal

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Medium · published August 12, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 51.2th percentile for exploit probability.

44
days past CISA
deadline
CVSS v3.1
5.3
EPSS
1%
Percentile
51.2
In the wild
Confirmed
What it is

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00665 · 51.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-12T20:17Z
KEV added
2026-08-27 · due 2026-09-10
Affected products (2)
ProductVersionsFixed in
jfrog/artifactory< 7.146.357.146.35
jfrog/artifactory≥ 7.161.0, < 7.161.167.161.16
References (5)
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · [email protected]https://docs.jfrog.com/releases/docs/jfrog-security-advisories · [email protected]https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://openai.com/index/hugging-face-incident-and-the-road-ahead/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 10
    kev
  • 12 AUG 15:14Z
    Authenticated users may write data outside the intended Docker cache path
    cvelistv5