Reflected XSS Vulnerability in JetBrains TeamCity Storage Settings
CVE-2025-68268

5.4MEDIUM

Key Information:

Vendor

Jetbrains
Status
Teamcity
Vendor
CVE Published:
16 December 2025

What is CVE-2025-68268?

A reflected Cross-Site Scripting (XSS) vulnerability exists in JetBrains TeamCity, allowing attackers to inject malicious scripts via the storage settings page. If exploited, this flaw could enable unauthorized users to execute scripts in the context of authenticated users, potentially leading to data loss or account compromise.

Affected Version(s)

TeamCity 0 < 2025.11.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68268 : Reflected XSS Vulnerability in JetBrains TeamCity Storage Settings