CVE-2026-66382
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
Risk Assessment
This could lead to overwriting critical system files or placing malicious files, threatening system integrity.
Recommendation
Restrict write permissions and monitor write operations in Artifactory.
Other vulnerabilities in Artifactory
See all- CVE-2026-68754Medium
A repository publisher without delete permission may modify protected package content under specific conditions.
- CVE-2026-68753Medium
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- CVE-2026-66381Medium
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
- CVE-2026-66380Medium
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
- CVE-2026-66379Medium
An authenticated user may view private Puppet module metadata without repository read access.
- CVE-2026-66378Medium
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- CVE-2026-66377Medium
An unauthenticated user may access restricted repository information under specific conditions.
Original NVD description (English source)
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS