This vulnerability allows an authenticated user to write files outside the intended Artifactory work directory under specific conditions. The resulting arbitrary file creation or modification could compromise the integrity of the system and potentially expose sensitive data if the written files reside in privileged locations. The weakness is a classic path traversal (CWE‑22) scenario where the application fails to validate or constrain the destination path.

JFrog Artifactory self‑managed installations are affected. No product variant or version information is provided in the current disclosure, so all deployed instances of the Artifactory product may be vulnerable.

The CVSS score is 4.3, indicating moderate severity, and there is no EPSS data, with the vulnerability not listed in CISA’s KEV catalog. A notable implicit requirement is the possession of valid credentials, so the attack vector is likely limited to authenticated users. Because the conditions that enable the file write are not publicly detailed, the exact exploit path remains uncertain, but the lack of a high severity rating suggests that exploitation would require some application‑specific context to be fully realized.