Improper Path Restriction in JFrog Artifactory (CVE‑2026‑66384) Enables Authenticated Write Outside Docker Cache
What It Is – JFrog Artifactory suffers an Improper Limitation of a Pathname to a Restricted Directory flaw (CVE‑2026‑66384). An authenticated user can write files outside the intended Docker cache directory when certain remote‑repository settings are used.
Exploitability – The vulnerability is publicly disclosed and has an assigned CVSS Score ≈ 7.5 (High). Exploits require a valid Artifactory account, but no public exploit code is known yet.
Affected Products – JFrog Artifactory (all supported versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Control Objective – Secure Configuration & Directory Access – The flaw shows a gap in enforcing proper file‑system boundaries, a core control that maps to many frameworks (e.g., NIST CSF 2.0 Protect function, ISO 27001 A.9).
- Continuous Evidence – Demonstrating that repository paths are locked down and monitored provides audit‑ready evidence of due diligence.
- Enterprise Buyer Expectation – Buyers now request proof that critical development pipelines are protected against unauthorized write‑access, making this control a decisive trust signal.
Recommended Actions
- Apply the JFrog‑issued patch immediately.
- Review and harden remote‑repository configurations; restrict write permissions to the minimal set of service accounts.
- Enable file‑system integrity monitoring for the Artifactory storage area and capture logs as control evidence.
- Update your configuration‑management policies to include periodic validation of directory‑access controls.
Source: CISA KEV – CVE‑2026‑66384