CVE-2021-3860 SQL injection in JFrog Artifactory

What is CVE-2021-3860?

CVE-2021-3860 is a high-severity SQL injection vulnerability in Jfrog Artifactory, published on 20 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.

Weakness: CWE-89

Which versions are affected by CVE-2021-3860?

1 open source package ship an affected version, including artifactory. It affects 1 product.

Products include Jfrog Artifactory.

How do I fix CVE-2021-3860?

Upgrade artifactory to a fixed version for your release line: 6.23.30, 7.11.8, 7.12.10 or 7.17.14.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-3860 being exploited?

There is no known exploitation of CVE-2021-3860 in the wild and no public exploit code.

Other vulnerabilities in Jfrog Artifactory

• CVE-2026-82329 JFrog Artifactory Improper Authentication Exploited Critical 9.8
• CVE-2026-42016 JFrog Artifactory Incorrect Authorization Exploited High 8.1
• CVE-2026-42018 JFrog Artifactory Improper Authentication Exploited High 7.5
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited Medium 5.3
• CVE-2019-17444 JFrog Artifactory does not enforce default admin password change Critical 9.8

All Jfrog Artifactory vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-artifactory-2021-3860, GHSA-p7mv-x2rc-847f.