EUVD-2026-42911
GHSA-j8x6-f4hm-gpqh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Teamcity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
1DescriptionCVE.org
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
Executive ViewAI
JetBrains TeamCity contains an authenticated file disclosure vulnerability in its Perforce integration that permits low-privilege users to read arbitrary files accessible to the TeamCity process, potentially exposing source code, deployment credentials, and build configuration. On shared CI infrastructure with multiple development teams, this creates significant insider threat and lateral-movement risk. Organizations must upgrade to 2026.1.2 immediately to prevent unauthorized data exfiltration.
24 hours: Inventory all TeamCity instances and current versions; audit users with Perforce VCS root creation permissions and restrict where possible. 7 days: Test and deploy version 2026.1.2 to development and staging environments; verify build functionality. 30 days: Complete production rollout of 2026.1.2 across all TeamCity servers; retire or patch any instances still on pre-2026.1.2 versions.
Apply vendor patch. Interim mitigations if immediate patching is blocked: restrict Perforce VCS root definition permissions to administrators only; implement file system least-privilege controls on TeamCity servers; audit Perforce integration logs for suspicious file access patterns; consider network segmentation to limit user access to TeamCity API.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify ve
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that
Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-white
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
Exploit-DB