EUVD-2026-33383
GHSA-f325-w28m-vh67
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
AnalysisAI
Reflected cross-site scripting on the TeamCity repository download page allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The Changed scope (S:C) in the CVSS vector indicates the payload can escape the vulnerable component and affect the victim's broader browser session, enabling session token theft, credential harvesting, or malicious redirects against TeamCity users. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected back into the HTTP response without adequate sanitization or encoding. In the reflected XSS variant, the malicious payload is embedded in the request itself (typically a URL parameter) and echoed directly into the rendered page, requiring no persistent storage. The affected component is the repository download page within JetBrains TeamCity, a widely deployed CI/CD server platform. The CPE string cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:* confirms the vulnerability is in the TeamCity application layer across all platform variants. The Changed scope (S:C) in the CVSS vector is significant for XSS: it indicates the injected script can access resources outside the vulnerable document's origin, such as session cookies or auth tokens associated with other TeamCity pages in the same browser context.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or 2025.11.5 (the two patched release lines) as the primary remediation - vendor-released patches are available per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. For organizations that cannot patch immediately, consider deploying a web application firewall (WAF) rule to inspect and block reflected XSS patterns in query parameters on the repository download endpoint; note that WAF rules may produce false positives on legitimate download requests and require tuning. Additionally, enforcing strict Content-Security-Policy (CSP) headers on the TeamCity server can limit the impact of any successfully injected script by restricting script execution sources, though this requires server configuration access and may affect legitimate TeamCity UI functionality. Security awareness for users accessing TeamCity via emailed or external links should be reinforced, particularly for admin accounts, as session hijacking via reflected XSS is the most impactful exploitation path in this environment.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today