CVE-2025-57733: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2025.07.1, an SMTP injection vulnerability was discovered that allowed modification of email content. The vulnerability was assigned CVE-2025-57733 and was disclosed on August 20, 2025. The affected software is JetBrains TeamCity, specifically versions prior to 2025.07.1 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 3.8 (LOW) by NIST and 5.5 (MEDIUM) by JetBrains. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, indicating that the vulnerability is network accessible, requires high privileges, but no user interaction. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')) (NVD).

The vulnerability allows attackers to modify email content through SMTP injection. This could potentially lead to unauthorized manipulation of system-generated emails, affecting both confidentiality and integrity of email communications (NVD).

The vulnerability has been fixed in TeamCity version 2025.07.1. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).