Jfrog: >> Artifactory >> 3.6.1 Security Vulnerabilities
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVSS Score
5.3
EPSS Score
0.003
Published
2026-08-12
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
CVSS Score
4.3
EPSS Score
0.003
Published
2026-08-12
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
CVSS Score
8.1
EPSS Score
0.003
Published
2026-08-12
Credentials for a deleted user may remain valid for a short period under specific conditions.
CVSS Score
4.2
EPSS Score
0.002
Published
2026-08-12
An unauthenticated user may access restricted repository information under specific conditions.
CVSS Score
5.3
EPSS Score
0.003
Published
2026-08-12
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-08-12
An authenticated user may view private Puppet module metadata without repository read access.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-08-12
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-08-12
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."
CVSS Score
7.2
EPSS Score
0.015
Published
2020-03-16
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.
CVSS Score
9.8
EPSS Score
0.256
Published
2018-05-01