JetBrains YouTrack EUVD-2026-90001

Requires an authenticated YouTrack account (PR:L) with the ability to store XHTML content that is subsequently rendered by the server-side PDF export feature; the SSRF fires only when that stored content is exported to PDF. Limiting factors: attacker must hold a valid account on the target instance, must be able to inject into a stored field that reaches the PDF renderer, and impact is confined to confidentiality (C:L, no integrity or availability effect). Affected versions are YouTrack before 2026.2.18991; upgrading to that build or later remediates the issue.

This is a low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects an authenticated SSRF with confidentiality-only impact and no integrity or availability effect. Exploitation requires an authenticated account (PR:L) capable of storing XHTML content that is later rendered during PDF export, so this is not an anonymous internet-facing threat. No EPSS score, CISA KEV listing, POC, or SSVC data is provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The SSRF is scope-unchanged (S:U) and limited to C:L, meaning the attacker can likely coax the server into issuing requests to internal endpoints and glean limited responses/metadata rather than achieve full internal resource disclosure. The realistic risk is an insider or low-privileged tenant user probing internal network services or cloud metadata endpoints from the YouTrack server. Overall this is a real but modest hardening fix, not an emergency; treat it as routine patching. Note: severity is vendor-reported (JetBrains) and no independent NVD enrichment or EPSS is present, so probability of exploitation cannot be quantified.

A low-privileged but authenticated YouTrack user stores crafted XHTML (e.g., an element referencing an internal URL) in an issue or field. When that content is later rendered during server-side PDF export, the YouTrack backend fetches the attacker-controlled URL, allowing the attacker to reach internal-only services or cloud metadata endpoints and receive limited responses. No public exploit code is identified at time of analysis.