CVE-2025-67742: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-67742 is a path traversal vulnerability in JetBrains TeamCity that allows exploitation via the file upload functionality. It affects all versions of JetBrains TeamCity before 2025.11. The vulnerability was published on December 11, 2025, with a patch available in TeamCity 2025.11. It carries a CVSS v3.1 base score of 7.5 (High) per NVD scoring, though ENISA's assessment scores it at 3.8 under a different vector reflecting high-privilege requirements (JetBrains Advisory, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). It arises from insufficient validation of file paths during file upload operations in TeamCity, allowing an attacker to craft upload requests that write files outside of the intended directory boundaries. Exploitation patterns associated with this class of vulnerability include using encoded slashes, alternate path encodings, or directory traversal sequences (e.g., ../) in filenames or upload parameters to escape the restricted upload directory (CAPEC-126, CAPEC-64, CAPEC-78). The ENISA advisory notes that exploitation requires high-privilege authentication, suggesting the vulnerable upload endpoint is accessible only to administrative or similarly privileged users (JetBrains Advisory, Red Hat CVE).

Successful exploitation by a high-privileged authenticated user could result in unauthorized file placement outside intended directories on the TeamCity server, potentially enabling modification of server configuration files, deployment of malicious scripts, or overwriting of sensitive files. The confidentiality impact is rated High under NVD's scoring, suggesting potential for reading files outside the intended scope. However, integrity and availability impacts are rated None in the NVD vector, and the overall risk is considered limited due to the high-privilege prerequisite (Red Hat CVE, JetBrains Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication. The EPSS score is extremely low at 0.000020 (approximately 0.002%), reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high-privilege authentication, significantly reducing the attack surface (Red Hat CVE).

JetBrains has released a fix in TeamCity version 2025.11; upgrading to this version or later is the primary recommended remediation (JetBrains Advisory). As interim mitigations, organizations should limit and audit high-privilege user accounts in TeamCity, implement strict file upload validation and sanitization at the application or WAF layer, and monitor file upload activity for anomalous path patterns. Applying the principle of least privilege to TeamCity user roles will reduce the risk of exploitation.

Coverage of CVE-2025-67742 has been limited, appearing primarily in automated vulnerability tracking feeds and aggregators such as Vulners, VulDB, and CVEFeed. The Secret CISO newsletter briefly referenced the vulnerability in its December 12, 2025 edition alongside other security disclosures. No notable independent researcher commentary or significant community discussion has been identified (Secret CISO).