CVE-2025-54530 is a high severity (CVSS 7.5) privilege escalation in JetBrains TeamCity caused by incorrect directory permissions. Versions before 2025.07 are affected. Upgrade to 2025.07 or later and review the permissions on your TeamCity directories. The sections below cover who is affected, how to check, and what to do first.
What's affected
- JetBrains TeamCity before 2025.07 is affected, per the record.
- Version 2025.07 is the first version after the boundary. JetBrains lists it on its issues fixed page.
The record lists CVSS 7.5 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
The TeamCity version is shown in the footer of the web interface and under Administration. Compare it with 2025.07.
On the server, check the owner and mode of the TeamCity install and data directories.
ls -ld /opt/TeamCity /opt/TeamCity/.BuildServer
Adjust the paths to match your install.
What to do now
- Upgrade TeamCity to 2025.07 or later.
- Check directory ownership and permissions after the upgrade.
- Run the server under a dedicated low privilege account.
- Review who has shell access to the build server.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-276, incorrect default permissions. A directory that other users can write to can let a lower privileged account influence what a higher privileged one runs.
CI servers hold signing keys, deployment tokens and source access. A local privilege escalation on that host is a supply chain issue, not only a server issue.
Severity scores are a starting point. The score for this entry is 7.5, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does this need local access?
The record does not say. Escalation flaws usually need some foothold, so limit who has one.
Where do I find the fix details?
On JetBrains' issues fixed page.
Sources
Last reviewed: 18 October 2026.
