JetBrains TeamCity CVE-2026-49375

The victim must be a TeamCity user who clicks a specially crafted URL pointing to the TeamCity repository download page while authenticated in a browser session. The CVSS vector confirms PR:N (no attacker authentication required) and UI:R (victim interaction is mandatory - exploitation cannot occur without the victim clicking the link). The attack is limited to the repository download page specifically, meaning the injection point is constrained to that endpoint. Exploitation is further limited by the need for social engineering to deliver the crafted URL; purely passive or server-side exploitation is not possible given the reflected nature of the vulnerability. No non-default configuration is required for the vulnerable endpoint to be reachable, provided TeamCity's web interface is network-accessible.

The CVSS base score of 6.1 (Medium) is consistent with a reflected XSS with Changed scope. Decomposing the vector: AV:N (exploitable over the network), AC:L (no special conditions to meet), PR:N (no authentication required of the attacker), UI:R (victim must interact - clicking a crafted link), S:C (cross-component impact), C:L/I:L (limited but real confidentiality and integrity impact). The PR:N and AC:L combination lowers the exploitation barrier significantly, but UI:R is the primary friction point - the attack depends entirely on social engineering the victim. EPSS data is not provided, and the vulnerability is not in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. No POC code has been identified. Real-world risk is moderate: TeamCity is frequently deployed in high-value DevOps environments where stealing a developer or admin session token via XSS could yield significant downstream access to pipelines, secrets, and repositories. The score likely understates business impact in privileged CI/CD contexts, even though the technical CVSS signals are medium-tier.

An attacker crafts a malicious URL targeting the TeamCity repository download page, embedding a JavaScript payload in a reflected query parameter, and delivers it to a TeamCity user - for example, a developer or CI/CD administrator - via phishing email, chat message, or a compromised external link. When the victim clicks the link while authenticated to TeamCity, their browser renders the injected script in the context of the TeamCity session, allowing the attacker to exfiltrate the session cookie or auth token. With a stolen admin session, the attacker could pivot to modifying build pipelines, accessing stored secrets, or injecting malicious code into CI/CD workflows. No public POC has been identified, but the low-complexity reflected XSS class is well understood and trivially reproducible.