JetBrains TeamCity Relative Path Traversal Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 4, 2024 · Catalog

   Detected

   JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

2. Apr 20, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. May 4, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

Affected

• cpe jetbrains/teamcityversion unspecified
• vendor JetBrains TeamCityversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2024-27199

  JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-27199

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-27199

  30-day exploitation probability 100.0%

  first.org
• Metasploit ModulesPublic exploit moduleexploit_multi/http/jetbrains_teamcity_rce_cve_2024_27198

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2024-27199

  In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

  nvd.nist.gov

References

• CISA note · blog.jetbrains.com
• Exploit · github.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Press/Media Coverage · darkreading.com
• CISA note · jetbrains.com