PT-2025-17924 · Jetbrains · Teamcity

Published 2025-04-25 · Updated 2025-05-16 · CVE-2025-46433

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2025.03.1

Description The issue is related to improper path validation in the loggingPreset parameter. This could potentially allow for unauthorized access or manipulation of files.

Recommendations For versions prior to 2025.03.1, update to version 2025.03.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the loggingPreset parameter to minimize the risk of exploitation.

Fix

Path traversal

Relative Path Traversal

Insertion into Log File

Weakness Enumeration

CWE-22

CWE-23

CWE-532

Related Identifiers

BDU:2025-05224

CVE-2025-46433

Affected Products

Teamcity

References · 8

• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46433 · Security Note
• https://bdu.fstec.ru/vul/2025-05224 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46433 · Vendor Advisory
• https://t.me/cvetracker/22385 · Telegram Post
• https://twitter.com/CVEnew/status/1915780626029949058 · Twitter Post
• https://t.me/cvedetector/23765 · Telegram Post
• https://t.me/cvenotify/122565 · Telegram Post