CVE-2020-7931

PoC —

CVSS 3.1

8.8 high

EPSS

5%p92

Published

Jan 23, 2020 (Jan 23, 2020)

Modified

Jun 17, 2026

Description

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

Vendors: jfrog
Products: artifactory
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.5%)

In the news0 stories

No ingested article mentions this CVE yet.