# CVE-2024-27199: JetBrains TeamCity relative path traversal in admin interface

Source: https://junglewise.ai/threats/cve-2024-27199-jetbrains-teamcity-relative-path-traversal-in-admin-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2024-27199 · Severity: critical · CVSS 7.3 · Exploited in the wild · Published 2026-04-20

JetBrains TeamCity, a popular platform for automating software builds and deployments, contains a security vulnerability that allows unauthorized users to perform administrative actions. An attacker could exploit this to bypass security controls and potentially interfere with the software development pipeline. This flaw has been reported as being actively exploited in the wild, posing a significant risk to organizational software integrity and operational continuity.

Technologies: [Jetbrains TeamCity](https://junglewise.ai/threats/technologies/teamcity). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2024-27199 exploited in the wild?** Yes. CVE-2024-27199 is known to be exploited in the wild, first recorded on 20 April 2026. Treat it as urgent.

**How severe is CVE-2024-27199?** Critical severity, with a CVSS score of 7.3, published 20 April 2026.

**Which products and versions are affected?** Jetbrains TeamCity Before 2023.11.4.

**Is there a fix for CVE-2024-27199?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-27199 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-27199?** Check whether you run Jetbrains TeamCity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability (CWE-23/CWE-22) exists in JetBrains TeamCity versions prior to 2023.11.4. The flaw allows a remote, unauthenticated attacker to bypass certain security constraints by manipulating file paths in web requests. Successful exploitation enables the attacker to perform a limited set of administrative actions on the server. This vulnerability is being actively exploited in the wild, often in conjunction with other flaws to establish persistent access or create rogue accounts. Users should update to version 2023.11.4 or later immediately.

## Affected products

- JetBrains TeamCity Before 2023.11.4

## Timeline

- 2024-03-04: disclosed: Initial NVD publication
- 2024-03-04: advisory: Vendor advisory released by JetBrains
- 2026-04-20: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [JetBrains TeamCity stored XSS in classic build log](https://junglewise.ai/threats/cve-2026-111096-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-stored)
- [JetBrains TeamCity stored XSS in project overview](https://junglewise.ai/threats/cve-2026-111095-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-stored)
- [JetBrains TeamCity remote code execution in build messages protocol](https://junglewise.ai/threats/cve-2026-111094-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-remote)
- [JetBrains TeamCity Git submodule URL validation bypass](https://junglewise.ai/threats/cve-2026-106219-in-jetbrains-teamcity-before-2026-2-1-missing-validation-of-git)
- [JetBrains TeamCity Kotlin DSL sandbox escape RCE](https://junglewise.ai/threats/cve-2026-106218-in-jetbrains-teamcity-before-2026-1-3-2025-11-7-kotlin-dsl)