CVE-2026-106219: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-106219 is a path/file disclosure vulnerability in JetBrains TeamCity caused by missing validation of Git submodule URLs, which allows authenticated attackers to read local repositories on the server. It affects all TeamCity versions before 2026.2.1 and was published on October 6, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NVD, or 6.5 (Moderate) per the GitHub Advisory Database and ENISA EUVD, reflecting differing assessments of the privileges-required metric (GitHub Advisory, JetBrains).

The root cause is classified as CWE-73 (External Control of File Name or Path): TeamCity fails to adequately validate Git submodule URLs supplied by users, allowing those URLs to reference local filesystem paths on the server rather than legitimate remote repositories. An attacker can craft a malicious Git submodule URL pointing to a local repository path (e.g., file:///etc/ or similar local URI schemes) and trigger TeamCity to fetch and expose its contents during build operations. Exploitation requires network access and at least low-level authenticated privileges within TeamCity, with no user interaction needed (GitHub Advisory, JetBrains).

Successful exploitation results in unauthorized read access to local Git repositories stored on the TeamCity server, posing a high confidentiality risk with no impact on integrity or availability. Sensitive data exposed could include source code, credentials, configuration files, or secrets embedded in local repositories. In environments where TeamCity has broad filesystem access, this could facilitate further lateral movement or privilege escalation by exposing credentials or internal infrastructure details (GitHub Advisory, JetBrains).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.64% (49th percentile), indicating a relatively low near-term exploitation probability. NVD's SSVC assessment classifies exploitation as "none" and automation as "no" at the time of analysis (GitHub Advisory).

1. Reconnaissance: Identify a TeamCity instance running a version prior to 2026.2.1 accessible over the network. Obtain or create a low-privileged user account on the TeamCity server.
2. Create or modify a project: Log in to TeamCity and create a new project or modify an existing one that uses a Git VCS root with submodule support enabled.
3. Craft malicious submodule URL: In the repository's .gitmodules file or VCS root configuration, specify a submodule URL using a local file URI scheme (e.g., file:///var/lib/teamcity/system/git/ or another local path containing sensitive repositories).
4. Trigger a build or checkout: Initiate a build or VCS checkout operation in TeamCity that processes the submodule configuration, causing the server to fetch and expose the contents of the targeted local repository path.
5. Exfiltrate data: Retrieve the exposed repository contents from build artifacts, build logs, or VCS checkout results, potentially accessing source code, secrets, or configuration files stored locally on the server (GitHub Advisory, JetBrains).

• Logs: TeamCity build logs showing VCS checkout operations referencing file:// or local path-based submodule URLs; unexpected access to local filesystem paths in server-side Git operation logs.
• Network: Authenticated API or UI requests from unusual source IPs creating or modifying VCS roots or project configurations with file:// URI schemes in submodule settings.
• File System: Unexpected read access patterns on local Git repository directories by the TeamCity service account; build artifacts containing contents of local server repositories not associated with legitimate remote sources.
• Process: TeamCity server process (java) performing Git operations against local filesystem paths rather than remote URLs during build execution.

The primary remediation is to upgrade JetBrains TeamCity to version 2026.2.1 or later, which includes proper validation of Git submodule URLs (JetBrains, GitHub Advisory). As interim mitigations, administrators should restrict network access to TeamCity instances, limit user privileges to the minimum necessary, and audit existing VCS root and submodule configurations for suspicious file:// or local path entries. Monitoring build logs for anomalous local path references in Git submodule URLs is also recommended.

Security news outlets including SecurityOnline.info and Daily Security Review covered this vulnerability as part of broader JetBrains patch reporting, noting it alongside other fixes in the TeamCity 2026.2.1 release. Tenable released Nessus plugin 364475 and a pipeline issue entry to detect affected systems. No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.