CVE-2025-54531 is a high severity (CVSS 7.7) path traversal in JetBrains TeamCity, possible via plugin unpacking on Windows. Versions before 2025.07 are affected. Upgrade to 2025.07 or later and review which plugins your server installs. The sections below cover who is affected, how to check, and what to do first.
What's affected
- JetBrains TeamCity before 2025.07 is affected, per the record.
- The record ties the issue to Windows.
The record lists CVSS 7.7 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the TeamCity version in the web interface footer and compare it with 2025.07. Confirm whether your server runs on Windows.
List the plugins installed under Administration and note where each came from.
What to do now
- Upgrade TeamCity to 2025.07 or later.
- Review installed plugins and remove any you do not use or trust.
- Limit who may upload plugins.
- Check the server file system for unexpected files outside plugin folders.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-23, relative path traversal. When an archive is unpacked, each entry path must be resolved and checked against the target folder. Windows path rules add more ways to write the same path, which is why the record names the platform.
Plugin installation is a trust decision. A traversal bug turns a plugin archive into a file write anywhere the server account can reach.
Severity scores are a starting point. The score for this entry is 7.7, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Am I affected on Linux?
The record describes the issue as occurring on Windows. Upgrade anyway.
Do I need to be an admin to exploit it?
The record does not say. Plugin management is typically an admin function, so review who holds it.
Sources
Last reviewed: 18 October 2026.
