CVE-2026-65921: JFrog Artifactory Path Traversal Flaw

CVE-2026-65921 Overview

CVE-2026-65921 is a path traversal vulnerability in JFrog Artifactory affecting archive extraction and write handling. The flaw allows archive entries containing traversal sequences such as ../ to be written outside the intended build artifacts directory. An authenticated attacker with network access can leverage this weakness to place files at arbitrary locations on the Artifactory host. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
A low-privileged, authenticated user can write files outside the build artifacts location, enabling potential overwrite of configuration or binaries and follow-on code execution on the Artifactory server.

Affected Products

JFrog Artifactory (self-managed)
JFrog Artifactory build artifact handling component
Deployments processing archive uploads or extracting build artifacts

Discovery Timeline

2026-07-27 - CVE-2026-65921 published to the National Vulnerability Database
2026-07-30 - Record last modified in NVD

Technical Details for CVE-2026-65921

Vulnerability Analysis

The vulnerability resides in the archive extraction and write logic used by JFrog Artifactory when processing build artifacts. The code does not properly validate entry names inside archives before writing them to disk. Archive entries can include relative path segments such as ../ that escape the target directory during extraction. This class of flaw is commonly known as a Zip Slip issue.

An attacker uploads a crafted archive whose entries contain traversal sequences. When Artifactory extracts the archive, the resolved path traverses outside the intended build artifacts directory. The attacker requires only low-privileged authenticated access over the network, and no user interaction is needed.

Successful exploitation can compromise the confidentiality, integrity, and availability of the Artifactory host. Attackers can overwrite trusted binaries, configuration files, cron entries, or SSH authorization files. In many deployments this leads to remote code execution under the Artifactory service account.

Root Cause

The root cause is missing or insufficient canonicalization of archive entry names before file write operations. The extraction routine trusts the archive-supplied path and does not verify that the resolved destination remains within the target base directory.

Attack Vector

Exploitation is performed over the network by an authenticated user with permission to upload or trigger extraction of archives. The attacker crafts an archive (for example a ZIP or TAR file) whose entry names contain sequences such as ../../etc/cron.d/payload. Once Artifactory processes the archive, the entry is written to the traversed path. See the JFrog Security Advisories for vendor-authored technical detail.

// No verified public proof-of-concept is available for CVE-2026-65921.
// The vulnerability class is standard archive path traversal (Zip Slip):
// an archive entry name such as "../../../etc/target_file" bypasses
// the intended extraction directory when the extractor does not
// canonicalize and verify the resolved path against the base directory.

Detection Methods for CVE-2026-65921

Indicators of Compromise

Unexpected files appearing outside the configured Artifactory build artifacts directory, particularly in system paths such as /etc, /var/spool/cron, or user home directories.
Archive uploads whose entry listings contain .. sequences, absolute paths, or backslash-separated traversal segments.
Artifactory service account writing to filesystem locations it does not normally touch.
Unexplained modifications to Artifactory startup scripts, plugins, or configuration files following an archive upload event.

Detection Strategies

Inspect archive contents at ingress and reject entries containing .., absolute paths, or symlinks that resolve outside the extraction root.
Enable and review Artifactory access and request logs for archive upload endpoints correlated with subsequent filesystem changes.
Deploy file integrity monitoring on the Artifactory host to alert on writes outside declared artifact storage locations.
Use endpoint behavioral analytics to identify the Artifactory process writing to atypical paths, a pattern the SentinelOne Singularity Platform surfaces through its behavioral AI engine and Storyline attack reconstruction.

Monitoring Recommendations

Forward Artifactory audit logs and host filesystem events into a central data lake for correlation across upload and write activity.
Alert on any process spawned by the Artifactory service account outside expected binaries.
Track anomalous volume of archive uploads from a single principal, especially from accounts that do not normally publish builds.

How to Mitigate CVE-2026-65921

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed version as listed in the JFrog Artifactory Release Notes.
Review the JFrog Security Advisories for the specific patched build corresponding to your deployment.
Audit recent archive uploads and extraction events for entries containing traversal sequences.
Restrict archive upload permissions to trusted build service accounts until patching is complete.

Patch Information

JFrog has published fixed releases for Artifactory. Consult the vendor release notes to identify the minimum patched version applicable to your deployment channel. Apply patches to all cluster nodes and confirm the fixed version is reported by the Artifactory system endpoint after upgrade.

Workarounds

Reduce the set of users and tokens with permission to deploy archives or trigger build artifact extraction.
Place the Artifactory data directory on a filesystem mount that limits write access outside the intended paths using mandatory access controls such as SELinux or AppArmor.
Run Artifactory under a dedicated low-privilege service account with no write access to system directories.
Front Artifactory upload endpoints with a proxy or scanner that inspects archive metadata and blocks entries containing .. or absolute path components.

bash

# Example: enumerate archive entries for traversal sequences before upload
unzip -l suspect.zip | awk '{print $4}' | grep -E '(^/|\.\./|\\)'

# Example: verify installed Artifactory version after patching
curl -s -u admin:$TOKEN https://artifactory.example.com/artifactory/api/system/version