CVE-2026-65921

Think of Artifactory as a warehouse for software “packages.” This issue is like a trick in the shipping label: an attacker can put hidden “go up to another folder” instructions inside an archive so that, when the system unpacks it, files can land in places they shouldn’t. In practice, that can overwrite important application files or disrupt services, and in the worst case enable further compromise.

This matters if your business uses JFrog Artifactory to receive, store, or process software archives (for example, when uploading or importing package files). Because attackers can exploit it through network access and with low authentication requirements, it’s especially important if your Artifactory is reachable from outside your internal network. Only worry if your Artifactory processes untrusted archive files and performs extraction without proper path validation (the vulnerability’s stated precondition).

RED: This is actively being exploited in real-world incidents, not just a theoretical bug. Attackers can use crafted archive uploads over the network to make Artifactory write files to unintended locations, which can lead to high-impact outcomes like overwriting critical files or causing major disruption.