CVE-2023-42661 JFrog Artifactory Improper input validation leads to arbitrary file write
An authenticated attacker can write arbitrary files via insufficient artifact validation, potentially leading to remote code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-42661?
CVE-2023-42661 is a high-severity path traversal vulnerability in Jfrog Artifactory, published on 7 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.
Weakness: CWE-20
Which versions are affected by CVE-2023-42661?
1 open source package ship an affected version, including artifactory. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
artifactory Bitnami | All versions | 7.76.2 |
Products include Jfrog Artifactory.
How do I fix CVE-2023-42661?
Upgrade artifactory to 7.76.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-42661 being exploited?
There is no known exploitation of CVE-2023-42661 in the wild and no public exploit code.
Other vulnerabilities in Jfrog Artifactory
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization
- CVE-2026-42018 JFrog Artifactory Improper Authentication
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
- CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Sources
Also known as BIT-artifactory-2023-42661, GHSA-362p-vjvc-766v.