JetBrains TeamCity CVE-2025-67741

Exploitation requires a valid authenticated TeamCity account with at least low-level privileges (PR:L) to write the malicious payload into the vulnerable session attribute, and it requires a second user to subsequently render the affected content (UI:R) for the script to fire. It is therefore not exploitable by fully unauthenticated attackers and depends on both account access and victim interaction; impact is limited to script execution in the victim's authenticated browser context (C:L/I:L, no availability impact). Affects JetBrains TeamCity server builds prior to 2025.11.

This is a moderate, not a top-priority, issue. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a stored XSS that is network-reachable with low complexity but gated by two meaningful limiters: it requires an authenticated TeamCity user (PR:L) to inject the payload and requires a victim to view the affected content (UI:R). The scope change (S:C) and C:L/I:L reflect that injected script executes in another user's browser context rather than directly compromising the server. The EPSS score of 0.49% (40th percentile) is low, indicating no significant mass-exploitation signal. There is no CISA KEV listing and no public exploit code referenced in the provided data, so there is no evidence of active exploitation. Signals are internally consistent: a low-privilege-but-authenticated web flaw with modest impact and low exploitation probability. No conflicting data was observed, though the only reference is a generic JetBrains 'issues fixed' advisory page rather than a CVE-specific writeup, so precise affected-build granularity below '2025.11' is not independently confirmed.

An authenticated TeamCity user with low privileges stores a malicious script via a vulnerable session attribute; when another user (such as an administrator) views the affected page, the script executes in their browser session. No public exploit code was identified at time of analysis, so this reflects the mechanics implied by the CVSS vector rather than a demonstrated PoC. Because exploitation needs both a valid account and victim interaction, it is most plausible as an insider or compromised-account escalation path rather than opportunistic remote attack.