A privilege escalation vulnerability in JetBrains TeamCity, stemming from improper directory permissions, poses a significant risk to internal server security.

The vulnerability is classified as CWE-276, relating to incorrect default permissions. It allows an authenticated local attacker with low privileges to potentially escalate their access rights within the application environment.

The ability for a low-privileged user to escalate privileges poses a severe threat to the integrity and confidentiality of the build server environment. Given the CVSS score of 7.5, this high-severity flaw could allow an attacker to gain unauthorized control over CI/CD pipelines, potentially facilitating supply chain attacks or unauthorized access to sensitive source code and deployment credentials.

Immediate Action: Upgrade all instances of JetBrains TeamCity to version 2025.07 or later to resolve the underlying directory permission issue.

Proactive Monitoring: Review system access logs for unusual account activity, specifically focusing on privilege changes or unauthorized access attempts to sensitive application directories.

Compensating Controls: Ensure the TeamCity server is running with the principle of least privilege, restricting file system access to only necessary service accounts to limit the potential impact of local privilege escalation.

Public Exploit Available: Unknown

This vulnerability represents a significant security gap in the CI/CD infrastructure, which is a common target for advanced persistent threats. Administrators should prioritize the update to version 2025.07 immediately to prevent unauthorized privilege escalation and ensure the security of build processes.