CVE-2026-111095: CWE-79 in JetBrains TeamCity

JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a stored cross-site scripting (CWE-79) vulnerability in the classic project overview. This flaw allows attackers with limited privileges and requiring user interaction to inject malicious scripts that execute with high impact on confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, user interaction needed, and scope change with high impact on all security properties.

Successful exploitation could lead to execution of arbitrary scripts in the context of other users, potentially resulting in data theft, session hijacking, or other malicious actions compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected functionality and apply any recommended workarounds from JetBrains advisories.