JetBrains TeamCity installations before 2026.2.1 contain a flaw where Git submodule URLs are not validated, enabling an attacker to configure a build that points a submodule to a local path on the server. When the build runs, TeamCity retrieves the submodule, inadvertently exposing the contents of the local repository or other files on the server. The vulnerability is a classic relative path traversal weakness, classified as CWE‑73, and could lead to unintended disclosure of source code, configuration files, or other sensitive data.

All JetBrains TeamCity instances running a version older than 2026.2.1 are vulnerable, regardless of specific build setup. This includes organizations that use TeamCity for automated builds and deployments and have user roles that can define or modify build configurations.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker would need the ability to create or modify build configurations to supply a malicious submodule URL, but the exact level of required privileges is not specified in the available data. Once that prerequisite is met, the flaw can be exploited without additional system compromises.