CVE-2025-46433 is a medium severity path traversal flaw (CVSS 4.9) in JetBrains TeamCity before 2025.03.1. The record says path validation for the loggingPreset parameter was improper, and the vector requires high privileges. Upgrade to TeamCity 2025.03.1 or later and limit who holds administrator rights on the server.
What's affected
The NVD record, published by JetBrains, says TeamCity versions before 2025.03.1 are affected. The fix is in 2025.03.1.
The vector sets the privileges required to high, which means the caller needs administrator level access to the server. That is why the score is 4.9, with the impact limited to integrity. The record gives few details beyond the parameter name and the weakness type.
How to check if you're exposed
Check the TeamCity server version.
- In the TeamCity web interface, open Administration and read the version shown in the footer or on the server health page.
- Docker users: run the command shown below and look at the jetbrains/teamcity-server tag.
- Kubernetes users: run the command shown below and filter for teamcity.
- Any build number older than 2025.03.1 is in the affected range.
Also review the list of users with server administrator rights, because the flaw needs that role.
Commands referred to above, in order:
docker ps --format '{{.Image}}'
kubectl get pods -A -o jsonpath='{..image}'
What to do now
- Find every TeamCity server, including test and agent management instances, and note the version.
- Upgrade each server to 2025.03.1 or later, following JetBrains upgrade notes.
- Review administrator accounts and remove those that are not needed.
- Turn on multi factor authentication through your single sign on provider where possible.
- Check audit logs for changes to logging settings made by unfamiliar accounts.
- Keep the server off the public internet where your workflow allows it.
Why it matters
The record lists CWE-22 (Path Traversal), CWE-23 (Relative Path Traversal). Path traversal happens when an application builds a file path from user supplied input and does not confine it to the intended folder. Using relative path elements, a request can then point at files elsewhere.
Build servers hold source code, deployment credentials and signing keys, so even a medium rated flaw deserves a patch window. The requirement for administrator rights lowers urgency but does not remove it, since administrator accounts are a frequent target. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Which version fixes it?
TeamCity 2025.03.1, according to the record.
Does an attacker need to be logged in?
The vector requires high privileges, so administrator level access is needed.
Sources
Last reviewed: 18 October 2026.
