JetBrains YouTrack versions prior to 2026.2.18991 allow a stored XHTML injection that is executed when a PDF is exported. The injected reference tags cause the YouTrack server to resolve and request the specified URL, enabling an attacker to force the server to make arbitrary outbound HTTP requests. This Server‑Side Request Forgery can expose internal services, leak sensitive data, or be used for pivoting within the network. The weakness is a failure to sanitize user‑supplied X‑HTML content used in PDF generation, which is classified under CWE‑918.

The vulnerability affects JetBrains YouTrack. Any instance running a version earlier than 2026.2.18991 and that allows users to create or edit the stored content that is later included in the PDF export is susceptible. The issue is fixed in 2026.2.18991 and later releases.

The CVSS score is 4.3, indicating a moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been publicly reported up to the moment of this analysis. Attackers would need to inject malicious XHTML via a user’s authenticated content that ultimately is rendered in a PDF export. The attack vector is likely through issue comments, descriptions, or custom fields that are persisted and later exported.