Authenticated path-limitation flaw in JFrog Artifactory: under specific remote-repository conditions a user may write outside the intended Docker cache path. NVD affected builds end before 7.146.35, and 7.161.0 through builds before 7.161.16. CVSS 5.3. Patch to 7.146.35 or 7.161.16 (or later).

Treat artifact caches as part of the software supply chain, not a side appliance.

UPDATE (26 Oct 2026): CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 10 September due date for US federal agencies, which means CISA has evidence it is being exploited.

JFrog's advisory rates it Medium and its CVE record scores it 5.3 (CVSS 3.1). (source: CISA KEV catalog)