CVE-2024-27199

JetBrains TeamCity, a widely used continuous integration/continuous delivery (CI/CD) server, contains a relative path traversal vulnerability (CWE-23) in which the application fails to properly neutralize traversal sequences in file paths. An attacker who can reach the vulnerable component can supply crafted relative paths that escape the intended directory, gaining the ability to perform limited administrative actions on the TeamCity server. Any organization running an affected JetBrains TeamCity deployment, especially instances exposed to the internet or reachable by untrusted users, is potentially affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-20 with known ransomware use, and the EPSS model assigns it a 100% probability of exploitation within the next 30 days. No public proof-of-concept is known, but the KEV listing confirms active exploitation in the wild per CISA.

What to do: Upgrade TeamCity to the patched release identified in JetBrains' security bulletin, or if patching is not immediately possible, apply vendor-recommended mitigations and restrict internet access to the server; federal agencies must follow BOD 22-01 guidance, including for cloud service offerings, or discontinue use if mitigations are unavailable. Given the known ransomware association, review TeamCity logs, admin accounts, and build-agent activity for signs of tampering as part of remediation.