CVE-2026-49375: TeamCity Reflected XSS on Repository Download Page – Patch Guidance

Technical summary

CVE-2026-49375 is a reflected XSS vulnerability (CWE-79) in TeamCity's repository download page. The flaw allows unauthenticated attackers to inject arbitrary JavaScript into the browser context of an authenticated user. Because the vulnerability is reflected (not stored), the attacker must socially engineer a victim into visiting a crafted link. The attack vector is network-based with low complexity, and successful exploitation results in limited confidentiality and integrity impact within the scope of the affected user's session.

Business impact

Exploitation could enable account takeover of individual TeamCity users, unauthorized repository access, or lateral movement to systems the compromised user can reach. For organizations using TeamCity as a central build and deployment platform, a compromised account could facilitate deployment of malicious artifacts, source code theft, or supply chain attacks. The impact is confined to the privileges of the compromised user, reducing organizational risk compared to unauthenticated remote code execution vulnerabilities.

Affected systems

JetBrains TeamCity versions before 2026.1 and 2025.11.5 are affected. Organizations running these versions should inventory their TeamCity instances and prioritize patching based on network exposure and user roles. Users with administrative or release-engineering privileges pose higher risk if compromised.

Exploitability

Exploitation requires no authentication or special privileges to craft the malicious URL, but successful attack depends entirely on user interaction. An attacker must convince a TeamCity user to click a link or visit an attacker-controlled page that frames the vulnerable endpoint. This significantly lowers the probability of large-scale automated exploitation compared to unauthenticated remote vulnerabilities. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active in-the-wild exploitation has been reported as of the publication date.

Remediation

Upgrade TeamCity to version 2026.1 or later, or apply the patch to version 2025.11.5 as recommended by JetBrains. Organizations unable to patch immediately should implement network segmentation to restrict TeamCity access to trusted users and networks, apply web application firewall (WAF) rules to detect XSS payloads on the repository download endpoint, and educate users about phishing-style attacks involving internal tools.

Patch guidance

Check the JetBrains TeamCity release notes and security advisories for the exact patched versions and rollout timeline. Deploy patches in a test environment first to verify compatibility with existing plugins, build configurations, and integrations. Prioritize patching instances exposed to the internet or accessible to a large user base. Consider scheduling maintenance windows during low-activity periods to minimize disruption to CI/CD pipelines.

Detection guidance

Monitor HTTP access logs for suspicious query parameters or encoded payloads on paths matching /repo/download or similar repository endpoints. Look for User-Agent headers, IP patterns, or referrers indicative of social engineering. Implement browser-based XSS detection in TeamCity if available, or deploy a WAF rule to block common XSS patterns (script tags, event handlers) in the affected parameter. Correlate user access logs with any suspicious downstream actions in CI/CD (unauthorized builds, artifact modifications).

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 6.1, this vulnerability warrants prompt but measured prioritization. The lack of KEV designation and unknown active exploitation lower immediate threat urgency. However, TeamCity is a high-value build system; even user-level compromise could enable supply chain attacks. Organizations with internet-facing TeamCity instances or where users frequently receive external links should prioritize patching within 30 days. Lower-priority environments or internally isolated instances can follow standard patching cadences.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network-accessible vulnerability requiring user interaction, no authentication, and limited direct impact (confidentiality and integrity of the user's session only). The score does not account for organizational context—the true risk depends on TeamCity's role in your pipeline, user access levels, and network exposure. Organizations deploying TeamCity as a central CI/CD hub with privileged users should treat this as higher-priority within their environment than the base score suggests.

Frequently asked questions