Listen to this Post
CVE-2026-66384 is a path traversal vulnerability in JFrog Artifactory that allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability arises from improper limitation of a pathname to a restricted directory, classified under CWE-22. When JFrog Artifactory handles Docker cache operations for remote repositories, it fails to properly neutralize special elements such as “../” sequences within pathnames, which can cause the pathname to resolve to a location outside the restricted directory.
An attacker with network access and low-level user privileges can exploit this weakness. The attack complexity is high, as it requires specific remote-repository and Docker-cache conditions to be met. No user interaction is required, and the scope remains unchanged. The vulnerability has no impact on confidentiality or availability but has a high impact on integrity—an attacker could potentially place or overwrite files beyond the intended cache boundary.
JFrog Artifactory versions before 7.146.35 and versions 7.161.0 through 7.161.16 are affected. The vulnerability was published on August 12, 2026, and CISA added it to its Known Exploited Vulnerabilities Catalog on August 27, 2026, with a due date of September 10, 2026. The CVSS v3.1 base score is 5.3 (MEDIUM). Active exploitation has been confirmed, making this a priority for remediation. JFrog cloud services are already patched; self-hosted instances must upgrade to 7.146.35 or 7.161.16.
DailyCVE Form:
Platform: JFrog Artifactory
Version: <7.146.35, 7.161.0-7.161.16
Vulnerability: Path Traversal (CWE-22)
Severity: MEDIUM (CVSS 5.3)
Date: August 12, 2026
Prediction: September 10, 2026
What Undercode Say:
Analytics indicate active exploitation in the wild. The vulnerability is particularly dangerous for internet-accessible or broadly reachable self-managed deployments with anonymous or weakly governed user accounts, Docker remote repositories, and shared CI/CD projects. Attackers are likely targeting container image poisoning, dependency manipulation, CI/CD artifact tampering, and persistence in shared build workflows. The following commands can help detect potential exploitation:
Audit unusual writes outside expected cache directories find /path/to/artifactory/data -type f -mtime -7 -ls | grep -v "/docker/cache/" Correlate repository access logs with new or modified image layers grep -E "PUT|POST|DELETE" /path/to/artifactory/logs/access.log | grep -i "docker" Review low-privilege account activity involving remote Docker repositories grep "remote-docker" /path/to/artifactory/logs/access.log | grep "user="
Exploit: (Educational Purposes!)
A successful exploit requires an authenticated user to craft a request with path traversal sequences targeting the Docker cache path under specific remote-repository conditions. The attacker must satisfy the remote-repository and Docker-cache requirements. While no public exploit has been indexed yet, the vulnerability is confirmed to be actively exploited.
Protection:
Apply the vendor’s fixed update (7.146.35 or 7.161.16) at the earliest emergency change window. Temporarily restrict remote Docker repositories and remove unnecessary write permissions. Isolate the service from build infrastructure and production networks where practical. Rotate credentials that accessed affected repositories and revalidate artifact integrity. If patching is delayed, use allow-listed source networks, stronger authentication, and heightened write monitoring.
Impact:
High integrity impact—attackers can modify or delete data within the affected component. Realistic attack outcomes include poisoning container images or dependencies, manipulating CI/CD artifacts, establishing persistence in shared build workflows, and undermining trust in released software. Altered artifacts could enable downstream lateral movement into build agents, registries, or production environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
