Platform
teamcity
Component
teamcity
Fixed in
2025.11
CVE-2025-67742 describes a Path Traversal vulnerability discovered in JetBrains TeamCity. This vulnerability allows an attacker to potentially access sensitive files on the server through manipulated file upload requests. The vulnerability affects versions 0 through 2025.11. A patch is available in version 2025.11.
The Path Traversal vulnerability in TeamCity allows an attacker to bypass access controls and read arbitrary files on the server hosting the application. This could include configuration files containing sensitive credentials, source code, or other confidential data. Successful exploitation could lead to data breaches, unauthorized access to systems, and potential compromise of the entire TeamCity environment. While the CVSS score is LOW, the potential impact of exposing sensitive server files warrants immediate attention and remediation.
CVE-2025-67742 was published on 2025-12-11. Severity is currently assessed as LOW. No public exploits or active campaigns targeting this vulnerability have been observed as of the publication date. The vulnerability is not listed on KEV or EPSS. Monitor security advisories and threat intelligence feeds for any updates regarding exploitation attempts.
Exploit Status
EPSS
0.01% (0% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-67742 is to upgrade JetBrains TeamCity to version 2025.11 or later, which contains the fix. If upgrading immediately is not possible, consider implementing stricter file upload validation rules on the TeamCity server to prevent malicious file names. This could involve whitelisting allowed file extensions and sanitizing user-provided file names to remove potentially harmful characters. Review TeamCity's file upload configuration and ensure proper access controls are in place. After upgrading, verify the fix by attempting a file upload with a path traversal payload (e.g., ../../../../etc/passwd) and confirming that access is denied.
Actualice JetBrains TeamCity a la versión 2025.11 o posterior. La actualización corregirá la vulnerabilidad de path traversal durante la carga de archivos. Consulte el sitio web de JetBrains para obtener instrucciones detalladas sobre cómo realizar la actualización.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-67742 is a Path Traversal vulnerability affecting JetBrains TeamCity versions 0–2025.11, allowing attackers to potentially access arbitrary files on the server via file upload.
If you are using JetBrains TeamCity versions 0 through 2025.11, you are potentially affected by this vulnerability. Upgrade to version 2025.11 or later to mitigate the risk.
The recommended fix is to upgrade JetBrains TeamCity to version 2025.11 or a later version. As a temporary workaround, implement stricter file upload validation rules.
As of the publication date, there are no reports of active exploitation campaigns targeting CVE-2025-67742. However, it's crucial to apply the patch promptly.
Refer to the official JetBrains security advisory for CVE-2025-67742 on the JetBrains website: [https://www.jetbrains.com/security/advisories/]
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.