JetBrains TeamCity CVE-2025-67742

Requires reaching TeamCity's file-upload functionality on a server running a version before 2025.11. The scored vector marks PR:N (unauthenticated), but file-upload endpoints in TeamCity are generally available only to authenticated users, so in practice a valid account/session is the likely realistic prerequisite - this discrepancy should be confirmed with JetBrains. Limiting factors: the flaw yields confidentiality impact only (no integrity/availability per C:H/I:N/A:N), no public exploit exists, and exploitation depends on the specific upload endpoint being exposed and the traversal-vulnerable code path being reachable in the deployed version.

Signals are moderate and partially conflicting. The NVD CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) frames this as a remotely reachable, confidentiality-only information-disclosure flaw with no integrity or availability impact. However, EPSS is low at 0.80% (55th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, so this is not currently an actively exploited or mass-weaponized issue. The most important tension: the vector claims PR:N (unauthenticated) and I:N, yet the root cause is a path traversal 'via file upload' in a CI/CD server where upload endpoints are normally gated behind authentication, and file-upload traversal commonly yields file WRITE (integrity) rather than pure read. This suggests the scored vector may understate the privilege prerequisite (PR:N likely should be PR:L) and possibly misclassify impact - verify with JetBrains. Net: treat as a real but moderate-priority patching item (reachable network service, confidentiality impact on a sensitive build server), not a drop-everything emergency, pending clarification of auth and impact scope.

An attacker with network reachability to a TeamCity server (and, realistically, a valid session since file-upload endpoints are typically authenticated) submits a file upload whose path contains traversal sequences, causing the server to read or place a file outside the intended directory and expose sensitive server-side files such as configuration or credentials. Because AC:L, exploitation is technically simple once the endpoint is reached, but no public proof-of-concept exists at time of analysis. Realistic impact is disclosure of confidential build-system data per the scored C:H/I:N/A:N vector.