PT-2026-1151 · Jfrog · Jfrog Artifactory

Published 2026-01-04 · Updated 2026-01-04 · CVE-2025-14830

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JFrog Artifactory (Workers) versions 7.94.0 through 7.117.9

Description An issue exists in JFrog Artifactory (Workers) that allows for Cross-Site Scripting (XSS). This is due to improper neutralization of input during web page generation. The issue affects the way data is processed and displayed, potentially allowing an attacker to inject malicious scripts into web pages viewed by other users. The vulnerable component is susceptible to XSS attacks, which could lead to the execution of arbitrary code in the context of a user's browser.

Recommendations Update to a version greater than or equal to 7.117.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14830

Affected Products

Jfrog Artifactory

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-14830 · Security Note
• https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories · Note
• https://twitter.com/CVEnew/status/2007751604955754685 · Twitter Post
• https://t.me/CVEtracker/41328 · Telegram Post