A path traversal vulnerability in JetBrains TeamCity versions prior to 2025.07 poses a significant risk of unauthorized file access and system compromise.

This is a path traversal flaw (CWE-23) triggered during the plugin unpacking process on Windows operating systems. The vulnerability requires high privileges (PR:H) to initiate, allowing an authenticated attacker to potentially write files to unintended locations on the host filesystem.

The ability to perform path traversal can lead to unauthorized access to sensitive configuration files, the injection of malicious code, or the modification of system components. Given the CVSS score of 7.7, this is a High severity issue that could facilitate lateral movement or complete system takeover if an attacker gains the necessary administrative access to the TeamCity interface.

Immediate Action: Update all JetBrains TeamCity instances to version 2025.07 or later to resolve the underlying path traversal flaw.

Proactive Monitoring: Review server access logs for unusual file operations or attempts to upload malformed plugin packages that deviate from standard deployment patterns.

Compensating Controls: Ensure that the TeamCity service account operates with the principle of least privilege, restricting its ability to write to sensitive system directories outside of the designated application paths.

Public Exploit Available: exploit_available (false)

Organizations utilizing JetBrains TeamCity should treat this vulnerability with high priority. Administrators must verify their current version and perform the necessary updates to version 2025.07 immediately to eliminate the risk of path traversal. Failure to patch may leave the build server vulnerable to unauthorized file manipulation if an account with high privileges is compromised.