CVE-2026-66384: JFrog Artifactory
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
- Vendor
- JFrog
- Product
- Artifactory
- Vulnerability
- JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Date added
- Aug 27, 2026
- CISA due date (U.S. federal agencies)
- Sep 10, 2026
- Known ransomware campaign use
- Unknown
- Weakness (CWE)
- CWE-22
References
This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.
Last updated: · Catalog version 2026.10.02