CVE-2025-54530: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2025.07, a privilege escalation vulnerability was discovered due to incorrect directory permissions. The vulnerability was assigned CVE-2025-54530 and was reported by CrisprXiang and Hao Huang from FDU. The issue was disclosed on July 28, 2025, and affects JetBrains TeamCity installations prior to version 2025.07 (JetBrains Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H according to the NVD assessment. However, JetBrains' own assessment rated it with a CVSS score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. The vulnerability is categorized under CWE-276 (Incorrect Default Permissions) (NVD).

The vulnerability could lead to privilege escalation, potentially allowing attackers to gain elevated access to the system. The CVSS metrics indicate potential high impacts on confidentiality and integrity of the affected systems (NVD).

The recommended mitigation is to upgrade to JetBrains TeamCity version 2025.07 or later, which contains the fix for this vulnerability (JetBrains Advisory).