CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

What it is

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

What to do

Fix within your normal patch cycle and well before the CISA date. Check that your scanning covers this product so nothing is missed.

Priority

Plan: Fix within your normal patch cycle, before the CISA date.

Severity (CVSS)

5.3 medium

CISA assessment (SSVC)

actively exploited; needs manual effort per target; partial control or data exposure

Exploit probability (EPSS, 30 days)

0.7%, higher than 50% of all CVEs

Added to CISA KEV

27 August 2026

CISA fix-by date

10 September 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-22

References

• NIST NVD entry
• CISA KEV entry
• docs.jfrog.com/releases/docs/artifactory-self-managed-releases
• docs.jfrog.com/releases/docs/jfrog-security-advisories
• cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20In
• openai.com/index/hugging-face-incident-and-the-road-ahead/
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.