Cross-site scripting in JFrog Artifactory - CVE-2025-14830
Published: August 31, 2026
Vulnerability identifier: #VU146509
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-14830
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.
The vulnerability exists due to improper handling of the import validation mechanism in the import validation mechanism when processing import validation data in the user interface. A remote attacker can craft input that triggers a DOM-based cross-site scripting condition to execute arbitrary script code in the victim's browser.
Only Enterprise+ and Enterprise X deployments are vulnerable.
Affected software
JFrog Artifactory
How to mitigate CVE-2025-14830
Install security update from vendor's website.
JFrog Artifactory - update to 7.117.10