What’s Vulnerable › Vulnerabilities
CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-04-20
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-03-04 · updated 2026-06-17
- Weakness: CWE-23
Description
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
Summary
JetBrains TeamCity before 2023.11.4 contains a relative path traversal flaw that allows an attacker to perform limited admin actions. Rated CVSS 7.3 (high), it is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation and a public exploit or detection template available. All TeamCity instances older than 2023.11.4 are affected. Upgrade to 2023.11.4 or later, and follow vendor mitigations and BOD 22-01 guidance for cloud services or discontinue use if mitigations are unavailable.
تحتوي إصدارات JetBrains TeamCity الأقدم من 2023.11.4 على ثغرة تجاوز مسار نسبي (relative path traversal) تتيح للمهاجم تنفيذ إجراءات إدارية محدودة. صُنّفت الثغرة بدرجة 7.3 (عالية) وهي مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط وتوفر أداة استغلال عامة أو قالب كشف. تتأثر جميع نسخ TeamCity الأقدم من 2023.11.4. يجب الترقية إلى 2023.11.4 أو أحدث، واتباع إرشادات المورّد وتوجيهات BOD 22-01 للخدمات السحابية، أو إيقاف استخدام المنتج إذا لم تتوفر المعالجات.
Affected products
- JetBrains TeamCity: before 2023.11.4 — fixed in 2023.11.4
How to fix
Upgrade to a fixed version: JetBrains TeamCity 2023.11.4. Check the vendor advisory for mitigations.
References
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199
Get alerted when CVE-2024-27199 or the next vulnerability affects your stack