This vulnerability (CVE-2026-66384) involves a directory traversal issue (CWE-22) in JFrog Artifactory that allows an authenticated user to write data outside the designated Docker cache directory when specific remote repository configurations are present. The flaw arises from insufficient validation or restriction of pathname inputs, enabling unauthorized file writes beyond intended boundaries. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An authenticated user can write files outside the intended Docker cache path, potentially leading to unauthorized modification of files or data integrity issues within the Artifactory environment. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor JFrog's advisories for updates. Until a fix is available, restrict authenticated user permissions and carefully review remote repository configurations to minimize exposure.