Jetbrains Teamcity vulnerabilities
284 known vulnerabilities affecting jetbrains/teamcity.
Total CVEs
284
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL30HIGH59MEDIUM186LOW9
Vulnerabilities
Page 2 of 15
CVE-2025-46618P3MEDIUMCVSS 6.1fixed in 2025.03.12025-04-25
CVE-2025-46618 [MEDIUM] CWE-79 CVE-2025-46618: In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
nvd
CVE-2026-65907P3CRITICALCVSS 9.1fixed in 2026.1.2, 2025.11.62026-07-23
CVE-2026-65907 [CRITICAL] CWE-94 CVE-2026-65907: In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
nvd
CVE-2026-100254P3HIGHCVSS 8.8fixed in 2025.11.8≥ 2026.1, < 2026.1.4+1 more2026-09-30
CVE-2026-100254 [HIGH] CWE-78 CVE-2026-100254: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute command
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
nvd
CVE-2026-100253P3HIGHCVSS 8.8fixed in 2025.11.8≥ 2026.1, < 2026.1.4+1 more2026-09-30
CVE-2026-100253 [HIGH] CWE-184 CVE-2026-100253: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
nvd
CVE-2022-24331P3CRITICALCVSS 9.8fixed in 2021.42022-02-25
CVE-2022-24331 [CRITICAL] CVE-2022-24331: In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
nvd
CVE-2025-46433P3CRITICALCVSS 9.8fixed in 2025.03.12025-04-25
CVE-2025-46433 [CRITICAL] CWE-23 CVE-2025-46433: In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possi
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
nvd
CVE-2024-31138P3MEDIUMCVSS 5.4fixed in 2024.032024-03-28
CVE-2024-31138 [MEDIUM] CWE-79 CVE-2024-31138: In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
nvd
CVE-2019-12157P3CRITICALCVSS 9.8fixed in 2018.2.52019-10-02
CVE-2019-12157 [CRITICAL] CWE-20 CVE-2019-12157: In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC comm
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
nvd
CVE-2025-54531P3CRITICALCVSS 9.4fixed in 2025.072025-07-28
CVE-2025-54531 [CRITICAL] CWE-23 CVE-2025-54531: In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
nvd
CVE-2024-56351P3HIGHCVSS 8.8fixed in 2024.122024-12-20
CVE-2024-56351 [HIGH] CWE-613 CVE-2024-56351: In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
nvd
CVE-2022-48428P3MEDIUMCVSS 5.4fixed in 2022.10.32023-03-27
CVE-2022-48428 [MEDIUM] CWE-79 CVE-2022-48428: In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
nvd
CVE-2022-48343P3MEDIUMCVSS 6.1fixed in 2022.10.22023-02-23
CVE-2022-48343 [MEDIUM] CWE-79 CVE-2022-48343: In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
nvd
CVE-2023-34225P3MEDIUMCVSS 5.4fixed in 2023.052023-05-31
CVE-2023-34225 [MEDIUM] CWE-79 CVE-2023-34225: In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
nvd
CVE-2023-34218P3CRITICALCVSS 9.8fixed in 2023.052023-05-31
CVE-2023-34218 [CRITICAL] CWE-863 CVE-2023-34218: In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions w
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
nvd
CVE-2023-39173P3HIGHCVSS 8.8fixed in 2023.05.22023-07-25
CVE-2023-39173 [HIGH] CWE-266 CVE-2023-39173: In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full a
In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
nvd
CVE-2023-34220P3MEDIUMCVSS 5.4fixed in 2023.052023-05-31
CVE-2023-34220 [MEDIUM] CWE-79 CVE-2023-34220: In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
nvd
CVE-2024-41827P3CRITICALCVSS 9.8fixed in 2024.072024-07-22
CVE-2024-41827 [CRITICAL] CWE-613 CVE-2024-41827: In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirati
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
nvd
CVE-2025-67742P3HIGHCVSS 7.5fixed in 2025.112025-12-11
CVE-2025-67742 [HIGH] CWE-22 CVE-2025-67742: In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
nvd
CVE-2023-41249P3MEDIUMCVSS 6.1fixed in 2023.05.32023-08-25
CVE-2023-41249 [MEDIUM] CWE-79 CVE-2023-41249: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
nvd
CVE-2022-36322P3HIGHCVSS 8.8fixed in 2022.04.2≥ 2022.04.2, < 2022.04.22022-07-20
CVE-2022-36322 [HIGH] CWE-88 CVE-2022-36322: In JetBrains TeamCity before 2022.04.2 build parameter injection was possible
In JetBrains TeamCity before 2022.04.2 build parameter injection was possible
nvd