JetBrains TeamCity Relative Path Traversal Vulnerability

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible

In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access

In JetBrains TeamCity before 2022.04.2 build parameter injection was possible

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible

In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset

In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions

In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent

In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC

In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters

In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings

In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases

In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user

In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible

In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS

In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange

In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible

In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible

In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters

JetBrains TeamCity Plugin before 2020.2.85695 SSRF