During configuration, JetBrains YouTrack allows administrators to import custom templates to standardize new project setups. In versions prior to 2026.2.19197, an attacker or user could provide a custom template that was unreadable by the system and still trigger project creation. This defect does not provide direct access to confidential data or code execution, but it may result in the creation of a project with incomplete or corrupted configuration, leading to usability issues or administrative confusion.

All releases of JetBrains YouTrack before the 2026.2.19197 build are affected. The bug is present in the core application and is triggered when a custom template is uploaded via the user interface. Affected customers include any organization that has deployed an older YouTrack version without applying the fix.

The CVSS score of 3.1 indicates low severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying limited exploitation. The likely attack vector involves an authenticated user with template upload privileges. An attacker can create a project from an unreadable template, potentially causing downstream issues. Because the vulnerability does not grant elevated privileges or data exfiltration, the overall risk is considered low.