In JetBrains TeamCity vor 2025.07 war über das Plugin-Entpacken unter Windows ein Pfadübersprung möglich

The Path Traversal vulnerability in TeamCity allows an attacker to bypass access controls and read arbitrary files on the server hosting the TeamCity instance. This is achieved by crafting malicious plugin packages that, when unpacked, contain paths that escape the intended directory structure. Successful exploitation could lead to the exposure of sensitive information such as configuration files containing database passwords, API keys, or even source code repositories. The potential for lateral movement is limited to the server hosting TeamCity, but the blast radius can be significant depending on the data stored on that server. This vulnerability shares similarities with other path traversal exploits where attackers leverage insufficient input validation to access unauthorized resources.

Organizations heavily reliant on JetBrains TeamCity for their CI/CD pipelines are particularly at risk. This includes development teams using TeamCity to automate builds, testing, and deployments. Environments with lax plugin installation policies or inadequate file system permissions are also more vulnerable.

• windows / teamcity:

Get-ChildItem -Path "C:\Program Files\JetBrains\TeamCity\plugins\*\" -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.FullName -match '\\..\\'}

• teamcity: Examine TeamCity server logs for plugin installation attempts from untrusted sources or unusual file access patterns during plugin unpacking. • generic web: Monitor TeamCity server access logs for requests attempting to access files outside of the expected plugin directory structure.

1. 2025-07-28Disclosure

   disclosure

1. Reserviert2025-07-24
2. Veröffentlicht2025-07-28
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-54531 is to upgrade TeamCity to version 2025.07 or later, which includes the fix. If an immediate upgrade is not possible, consider temporarily restricting plugin installations to trusted sources only. Implement strict file access controls on the TeamCity server to limit the impact of a potential breach. Monitor TeamCity logs for suspicious activity related to plugin installations and unpacking processes. While a WAF may not directly prevent this vulnerability, it can be configured to detect and block requests containing suspicious path traversal patterns. After upgrading, confirm the fix by attempting to install a test plugin and verifying that the unpacking process does not allow access to files outside the designated plugin directory.