{"id":"jfrog-artifactory-docker-path-write-aug-2026","category":"patch","status":"closed","title":"JFrog Artifactory Docker cache path-traversal flaw CVE-2026-66384 used in attacks; fixed in 7.146.35 and 7.161.16","tldr":"JFrog Artifactory flaw CVE-2026-66384 lets a signed-in user write files outside the Docker cache folder. CISA lists it as used in attacks. Self-hosted servers should upgrade to 7.146.35 or 7.161.16; JFrog says its cloud service needs no action.","summary":"CVE-2026-66384 is a path traversal flaw in JFrog Artifactory, the software many companies use to store and distribute software packages and container images. JFrog rates it medium (CVSS 5.3). A user who is already signed in can, under certain conditions involving remote repositories, write data outside the folder meant to hold the Docker cache. JFrog published its advisory on 12 August 2026. Versions before 7.146.35, and 7.161.0 through 7.161.16, are affected, and JFrog's fixed releases are 7.146.35 and 7.161.16. JFrog lists no workaround, and says its cloud-hosted service is already protected and needs no action. CISA added the flaw to its list of vulnerabilities being used in attacks on 27 August 2026. JFrog's own advisory does not say whether it has been exploited, and what the attacks involve has not been published in the sources read. It is a business system issue rather than a home one. Because exploitation needs a valid login, stolen or weak Artifactory accounts raise the risk. This is a different flaw from the Artifactory login bypass CVE-2026-82329.","action":"If your organisation runs its own Artifactory server, upgrade to 7.146.35 or 7.161.16 (or later) and review which accounts have access. JFrog-hosted cloud customers need to do nothing.","product":"JFrog Artifactory (self-hosted)","audience":"work","severity":"medium","patch":"patched","exploited":true,"cves":["CVE-2026-66384"],"tags":["jfrog","artifactory","path-traversal","docker","cisa-kev","devops","self-hosted"],"affected":["JFrog Artifactory before 7.146.35","JFrog Artifactory 7.161.0 through 7.161.16"],"fixed":["7.146.35","7.161.16"],"matches":[],"sources":[{"kind":"advisory","title":"JFrog Security Advisories","url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","by":"JFrog","date":"2026-08-12"},{"kind":"research","title":"CVE-2026-66384 – CVE Radar","url":"https://socradar.io/free-tools/cve-radar/CVE-2026-66384","by":"SOCRadar","date":"2026-08-27"},{"kind":"news","title":"JFrog Product Security Update Advisory (CVE-2026-66384)","url":"https://asec.ahnlab.com/en/95181/","by":"AhnLab ASEC","date":"2026-08-12"}],"started":"2026-08-12","closed":"2026-08-27","created":"2026-11-03T22:10:27.256Z","updated":"2026-11-03T22:10:27.256Z","cve_notes":[{"cve":"CVE-2026-66384","name":"Path traversal in Artifactory's Docker cache","what":"A path traversal flaw in how Artifactory handles Docker remote repositories lets a signed-in user write data outside the folder meant for the Docker cache.","severity":"medium","cvss":5.3}],"timeline":[{"at":"2026-08-27","added":"2026-11-03T22:09:50.672Z","kind":"cisa-added","text":"CISA added CVE-2026-66384 to its list of flaws being used in attacks. Secondary sources report a federal remediation deadline of 10 September 2026. JFrog's advisory page does not say the flaw has been exploited.","url":"https://socradar.io/free-tools/cve-radar/CVE-2026-66384","by":"SOCRadar","patch":null},{"at":"2026-08-12","added":"2026-11-03T22:09:50.672Z","kind":"disclosed","text":"JFrog published its advisory for CVE-2026-66384, a medium-severity flaw letting a signed-in Artifactory user write data outside the intended Docker cache path. It listed fixes in 7.146.35 and 7.161.16 and no workaround.","url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","by":"JFrog","patch":"patched"}],"url":"https://hard.fyi/live/jfrog-artifactory-docker-path-write-aug-2026/","json":"https://hard.fyi/api/live?id=jfrog-artifactory-docker-path-write-aug-2026"}