CVE-2020-7931: JFrog Artifactory

High severity, CVSS 8.8. EPSS: 5.5% chance of exploitation in the next 30 days.

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

Affected products

• JFrog Artifactory: before 5.11.8 (fixed in 5.11.8); from 6.0.0, before 6.1.6 (fixed in 6.1.6); from 6.2.0, before 6.3.9 (fixed in 6.3.9); from 6.4.0, before 6.7.8 (fixed in 6.7.8); from 6.8.0, before 6.8.17 (fixed in 6.8.17); from 6.9.0, before 6.9.6 (fixed in 6.9.6); …

Published 2020-01-23. Last modified 2026-06-17.