CVE-2024-47949

CVE-2024-47949 is a path traversal flaw (CWE-22/CWE-23) in JetBrains TeamCity's backup functionality that allows backup files to be written to an arbitrary location on the server's filesystem. It is triggerable over the network and, per the CVSS vector (AV:N/AC:L/PR:N/UI:N), requires no privileges or user interaction, meaning traversal sequences in a backup path can direct the write outside the intended directory. A successful attacker gains arbitrary file write on the TeamCity host (integrity impact, C:N/I:H/A:N), which can be used to tamper with or plant files on the server. Any TeamCity deployment running a version earlier than 2024.07.3 is affected, with internet-facing CI/CD servers the most exposed. There is currently no known public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation, although the 23.5% EPSS score (98th percentile) indicates an elevated predicted likelihood of exploitation within 30 days.

What to do: Upgrade all TeamCity servers to version 2024.07.3 or later. If an immediate upgrade is not possible, restrict network access to the TeamCity server to trusted users and networks, and review the filesystem for unexpected or recently modified files outside the backup storage path.