CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

+0.09 pp

From 0.58% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.66%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 27-08-2026
Federal due date: 10-09-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. docs.jfrog.com/releases/docs/jfrog-security-advisories docs.jfrog.com/releases/docs/artifactory-self-managed-releases nvd.nist.gov/vuln/detail/CVE-2026-66384

Public exploits

0 found

No public exploits indexed.

References

5 links

docs.jfrog.com/releases/docs/jfrog-security-advisoriesVendor Advisory
docs.jfrog.com/releases/docs/artifactory-self-managed-releasesVendor AdvisoryRelease Notes
cdn.openai.com/pdf/…Third Party AdvisoryTechnical Description
openai.com/index/hugging-face-incident-and-the-road-ahead/Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384Government ResourceUS Government Resource

Related vulnerabilities

CVE-2018-1000623jfrogartifactory2.82%8y ago09-07-2018 20:00JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint (/ui/artifactimport/upload) that can result in Directory traversal / file overwrite and remote code execution. This attack appear to be exploitable via An attacker with Admin privileges may use the aforementioned UI endpoint and exploit the publicly known "Zip Slip" vulnerability, to add/overwrite files outside the target directory. This vulnerability appears to have been fixed in 6.0.3.CVE-2018-1000206jfrogartifactory0.76%8y ago13-07-2018 18:00JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.CVE-2018-1000424jfrogartifactory+10.33%7y ago09-01-2019 23:00An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.CVE-2018-19971jfrogartifactory3.03%7y ago16-04-2019 18:12JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.CVE-2021-41834jfrogartifactory0.60%4y ago23-05-2022 07:05JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.CVE-2021-45730jfrogartifactory0.56%4y ago19-05-2022 14:30JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.

All vulnerabilities inartifactory

CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References