Plattform
teamcity
Komponente
teamcity
Behoben in
2025.11
CVE-2025-67742 describes a Path Traversal vulnerability discovered in JetBrains TeamCity. This vulnerability allows an attacker to potentially access sensitive files on the server through manipulated file upload requests. The vulnerability affects versions 0 through 2025.11. A patch is available in version 2025.11.
The Path Traversal vulnerability in TeamCity allows an attacker to bypass access controls and read arbitrary files on the server hosting the application. This could include configuration files containing sensitive credentials, source code, or other confidential data. Successful exploitation could lead to data breaches, unauthorized access to systems, and potential compromise of the entire TeamCity environment. While the CVSS score is LOW, the potential impact of exposing sensitive server files warrants immediate attention and remediation.
CVE-2025-67742 was published on 2025-12-11. Severity is currently assessed as LOW. No public exploits or active campaigns targeting this vulnerability have been observed as of the publication date. The vulnerability is not listed on KEV or EPSS. Monitor security advisories and threat intelligence feeds for any updates regarding exploitation attempts.
Exploit-Status
EPSS
0.01% (0% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-67742 is to upgrade JetBrains TeamCity to version 2025.11 or later, which contains the fix. If upgrading immediately is not possible, consider implementing stricter file upload validation rules on the TeamCity server to prevent malicious file names. This could involve whitelisting allowed file extensions and sanitizing user-provided file names to remove potentially harmful characters. Review TeamCity's file upload configuration and ensure proper access controls are in place. After upgrading, verify the fix by attempting a file upload with a path traversal payload (e.g., ../../../../etc/passwd) and confirming that access is denied.
Aktualisieren Sie JetBrains TeamCity auf Version 2025.11 oder höher. Das Update behebt die (path traversal) Schwachstelle beim Hochladen von Dateien. Sehen Sie auf der JetBrains-Website nach detaillierten Anweisungen zur Durchführung des Updates.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-67742 is a Path Traversal vulnerability affecting JetBrains TeamCity versions 0–2025.11, allowing attackers to potentially access arbitrary files on the server via file upload.
If you are using JetBrains TeamCity versions 0 through 2025.11, you are potentially affected by this vulnerability. Upgrade to version 2025.11 or later to mitigate the risk.
The recommended fix is to upgrade JetBrains TeamCity to version 2025.11 or a later version. As a temporary workaround, implement stricter file upload validation rules.
As of the publication date, there are no reports of active exploitation campaigns targeting CVE-2025-67742. However, it's crucial to apply the patch promptly.
Refer to the official JetBrains security advisory for CVE-2025-67742 on the JetBrains website: [https://www.jetbrains.com/security/advisories/]
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.