JetBrains TeamCity CVE-2025-67739

Requires an authenticated user holding permission to create or edit a VCS root (repository URL) in JetBrains TeamCity before 2025.11.2; the attacker must supply a crafted repository URL that defeats the server's improper URL validation to elicit disclosure of local filesystem paths. Exploitation is limited by the need for valid low-privilege credentials (PR:L), by high attack complexity (AC:H) implying specific crafting or conditions are needed for reliable triggering, and by the fact that only path information is exposed - no secrets, write access, or code execution result.

This is a low-severity information-disclosure issue (CVSS 3.1, vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) and the available signals are internally consistent and point to low real-world priority. The CVSS vector indicates a network-reachable flaw that nonetheless requires low-privilege authentication (PR:L) and high attack complexity (AC:H), with only limited confidentiality impact (C:L) and no integrity or availability effect. EPSS reinforces this: a 0.17% exploitation probability at the 5th percentile indicates very low likelihood of observed exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. All signals agree - low severity, low EPSS, no KEV, no POC - so this is a genuinely low-priority hardening fix rather than a high-CVSS-but-low-risk anomaly or a conflicting-signal case. The only caveat is that the single reference is a generic JetBrains security-issues landing page, not a dedicated per-CVE advisory, so fixed-version detail relies on the NVD description text ('before 2025.11.2').

An authenticated TeamCity user with permission to configure a VCS root supplies a specially crafted repository URL that bypasses URL validation, causing the server to reveal local filesystem paths in its response or error output. The disclosed paths could aid reconnaissance for a follow-on attack, though the flaw itself only leaks path information and does not grant code execution or data modification. No public exploit code is known, and the high attack complexity means reliable exploitation is non-trivial.