SB20260831100 - Cross-site scripting in JFrog Artifactory

Security Bulletin ID SB20260831100

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2025-14830)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper handling of the import validation mechanism in the import validation mechanism when processing import validation data in the user interface. A remote attacker can craft input that triggers a DOM-based cross-site scripting condition to execute arbitrary script code in the victim's browser.

Only Enterprise+ and Enterprise X deployments are vulnerable.

Remediation

Install update from vendor's website.

References

https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2025-14830---improper-handling-of-import-validation-mechanism-could-lead-to-dom-based-cross-site-scripting