CVE-2025-54531: JetBrains TeamCity Path Traversal Flaw

CVE-2025-54531 Overview

CVE-2025-54531 is a critical path traversal vulnerability affecting JetBrains TeamCity on Windows systems. The vulnerability exists in the plugin unpacking mechanism, allowing attackers to write files to arbitrary locations outside the intended directory during plugin extraction. This flaw can be exploited remotely without authentication, potentially leading to complete compromise of the TeamCity server and connected build infrastructure.

Critical Impact

Unauthenticated remote attackers can exploit this path traversal vulnerability to write arbitrary files to the TeamCity server, potentially achieving remote code execution and compromising the entire CI/CD pipeline infrastructure.

Affected Products

• JetBrains TeamCity versions before 2025.07
• JetBrains TeamCity installations running on Windows operating systems
• TeamCity servers with plugin upload functionality enabled

Discovery Timeline

• 2025-07-28 - CVE-2025-54531 published to NVD
• 2025-07-31 - Last updated in NVD database

Technical Details for CVE-2025-54531

Vulnerability Analysis

This vulnerability is classified under CWE-23 (Relative Path Traversal), a weakness where the application fails to properly sanitize file paths during archive extraction operations. In the context of TeamCity, when a plugin archive is uploaded and unpacked, the extraction routine does not adequately validate file paths contained within the archive. Maliciously crafted plugin packages can include files with path traversal sequences that escape the designated plugin directory.

On Windows systems, the vulnerability is particularly impactful due to the operating system's file path handling characteristics. An attacker can craft a malicious plugin archive containing files with paths such as ..\..\..\..\path\to\target that, when extracted, write files to locations outside the plugin directory. This could include sensitive system directories, TeamCity configuration files, or executable locations that would be run by the TeamCity service.

Root Cause

The root cause of CVE-2025-54531 lies in insufficient input validation within the plugin unpacking functionality. When TeamCity processes plugin archives, the extraction logic fails to normalize and validate file paths before writing files to disk. The lack of proper path canonicalization allows archive entries containing relative path components (such as .. or ..\) to traverse outside the intended extraction directory.

This type of vulnerability, commonly known as "Zip Slip," occurs when archive extraction routines trust the file paths embedded in archive entries without verifying that the resolved destination path remains within the expected target directory.

Attack Vector

The attack is conducted over the network and requires no prior authentication or user interaction. An attacker can exploit this vulnerability by uploading a specially crafted plugin archive to the TeamCity server. The malicious archive contains entries with path traversal sequences in their filenames.

When TeamCity processes the uploaded plugin, it extracts the archive contents without properly sanitizing the embedded file paths. The path traversal sequences cause files to be written to arbitrary locations on the Windows file system, constrained only by the permissions of the TeamCity service account.

Potential attack scenarios include:

• Overwriting TeamCity configuration files to modify server behavior
• Writing malicious executables or scripts to directories in the system PATH
• Deploying web shells to accessible web directories
• Replacing legitimate binaries with malicious versions to achieve code execution on service restart

Detection Methods for CVE-2025-54531

Indicators of Compromise

• Unexpected files appearing outside the TeamCity plugin directories, particularly in system directories or web-accessible locations
• Plugin upload events in TeamCity logs immediately preceding suspicious file system activity
• Files with unusual naming patterns or timestamps in critical system directories
• Unauthorized modifications to TeamCity configuration files or executables

Detection Strategies

• Monitor file system activity on TeamCity servers for write operations to directories outside the plugin installation path
• Implement file integrity monitoring (FIM) on critical system directories and TeamCity installation folders
• Review TeamCity audit logs for unusual plugin upload activity, especially from unexpected IP addresses
• Deploy endpoint detection solutions to identify path traversal attack patterns in archive extraction operations
• Configure alerts for the creation of executable files in sensitive directories by the TeamCity process

Monitoring Recommendations

• Enable comprehensive audit logging for file system operations on the TeamCity server
• Set up real-time alerts for any file modifications in the TeamCity bin, conf, and webapps directories
• Monitor network traffic for plugin upload requests from unauthorized sources
• Implement centralized log collection and analysis to correlate plugin uploads with subsequent suspicious activity

How to Mitigate CVE-2025-54531

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2025.07 or later immediately
• Restrict plugin upload permissions to trusted administrators only
• Review recently uploaded plugins for any suspicious content
• Conduct a file system audit to identify any files written outside expected directories
• Consider temporarily disabling plugin upload functionality until the patch is applied

Patch Information

JetBrains has released TeamCity version 2025.07 which addresses this path traversal vulnerability. Organizations should update their TeamCity installations as soon as possible. Detailed information about security issues fixed in TeamCity releases is available from the JetBrains Security Issues Fixed advisory page.

Workarounds

• Implement strict network segmentation to limit access to the TeamCity server from untrusted networks
• Configure a web application firewall (WAF) to inspect and block requests containing path traversal patterns
• Restrict plugin upload functionality to only trusted internal administrators via TeamCity's role-based access control
• Deploy file integrity monitoring on the TeamCity server to detect unauthorized file modifications
• Run TeamCity under a dedicated service account with minimal file system permissions

# Restrict TeamCity service account permissions on Windows
# Run in PowerShell as Administrator

# Remove write permissions to sensitive directories
icacls "C:\Windows\System32" /deny "TeamCityServiceAccount:(W)"
icacls "C:\Program Files" /deny "TeamCityServiceAccount:(W)"

# Verify TeamCity installation permissions are properly scoped
icacls "C:\TeamCity" /T /Q