CVE-2025-67739: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-67739 is an improper repository URL validation vulnerability in JetBrains TeamCity that can lead to local filesystem path disclosure. It affects all TeamCity versions before 2025.11.2 and was published on December 11, 2025. The vulnerability is classified under CWE-939 (Improper Authorization in Handler for Custom URL Scheme) and carries a CVSS v3.1 base score of 3.1 (Low) (JetBrains Advisory, Red Hat CVE).

The root cause is insufficient validation of repository URLs supplied by authenticated users, classified as CWE-939 (Improper Authorization in Handler for Custom URL Scheme). By crafting a malicious repository URL, a low-privileged authenticated attacker can cause the server to resolve or expose local filesystem paths that should not be accessible. Exploitation requires network access and high attack complexity, meaning specific conditions or non-default configurations must be present for the attack to succeed (JetBrains Advisory, Red Hat CVE).

Successful exploitation allows an authenticated low-privilege user to disclose local filesystem paths on the TeamCity server, potentially revealing sensitive directory structures, configuration file locations, or internal infrastructure details. There is no impact on integrity or availability; the confidentiality impact is rated Low and is limited in scope. While path disclosure alone does not grant code execution, the exposed information could assist an attacker in chaining additional attacks against the server (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.000020, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the high attack complexity further limits practical exploitation risk (JetBrains Advisory, Red Hat CVE).

JetBrains has released a patch in TeamCity version 2025.11.2, which addresses the improper URL validation. Organizations should upgrade to version 2025.11.2 or later as the primary remediation step. As interim measures, administrators should restrict access to TeamCity interfaces to trusted users only, enforce strict role-based access controls, and monitor logs for unusual repository URL submissions or unexpected filesystem path references (JetBrains Advisory).