This vulnerability (CVE-2026-65921) in JFrog Artifactory is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It arises from insufficient validation of pathnames during archive extraction or write handling, permitting entries containing directory traversal sequences (e.g., '../') to escape the intended artifact storage location. This flaw can be exploited to write files outside the designated directory, potentially leading to arbitrary file overwrite or code execution. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Affected versions explicitly include 7.117.0, 7.125.0, 7.133.0, 7.146.0, and 7.161.0. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with limited privileges (PR:L) to write files outside the intended directory, potentially overwriting critical system or application files. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling untrusted archives and restrict access to the artifact extraction functionality to trusted users only.