A path validation weakness in Artifactory’s archive extraction and write handling allows archive entries containing directory traversal characters to be written outside the intended build artifacts location. An attacker could use this flaw to create or overwrite arbitrary files on the system, potentially replacing configuration files or executables and enabling further compromise or code execution. The weakness is a classic path traversal (CWE‑22).

JFrog Artifactory self‑managed installations are affected; specific product names include Artifactory for build artifact storage. No particular version range is provided in the advisory, so all released versions may be susceptible until a patch is applied.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score indicates a very low exploitation probability (<1%), and the absence from KEV suggests limited real-world exploitation. The likely attack vector is the Artifactory archive upload or extraction endpoint, which an attacker could target if they have network or authenticated access to the repository. Once triggered, the attacker can write arbitrary files, which could lead to privilege escalation or remote code execution if sensitive binaries or scripts are replaced.