A path traversal vulnerability in JFrog Artifactory allows authenticated attackers to overwrite sensitive system files by manipulating archive entries during extraction.

The software fails to properly validate paths within archive files during the extraction process. An authenticated attacker can include traversal sequences in archive entries to escape the intended build artifact location.

Exploitation of this path traversal flaw could lead to arbitrary file writes, potentially resulting in remote code execution or the corruption of critical system configurations. With a CVSS score of 8.8, this vulnerability poses a significant threat to the security and stability of the Artifactory server and its underlying host.

Immediate Action: Apply the vendor-provided security updates by upgrading to the latest patched version corresponding to your specific release stream.

Proactive Monitoring: Scan for files created in unexpected locations or anomalies in archive extraction logs that might suggest traversal attempts.

Compensating Controls: Implement strict file system permissions for the user account running the Artifactory service to limit the impact of potential directory traversal attacks.

Public Exploit Available: No

Organizations must identify their current Artifactory version and apply the corresponding patch immediately. The ability to write files outside of intended directories creates an unacceptable security risk and should be mitigated through prompt software updates.