CVE-2026-111095: XSS
Published Oct 15, 2026
·Updated
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
Affected Software
1 affected component
JetBrains TeamCity<2026.2, <2026.1.4, <2025.11.8
Event History
Oct 15, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which TeamCity deployments are affected?
JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8 are affected. The issue is in the classic project overview.
2
What does an attacker need to exploit this issue?
The vector is network-accessible, but exploitation has high attack complexity and requires low privileges. A victim must also interact with the stored malicious content.
3
What is the potential impact?
Successful exploitation can compromise confidentiality, integrity, and availability, with scope changed beyond the vulnerable component.
4
How should this be remediated?
Upgrade TeamCity to 2026.2, 2026.1.4, or 2025.11.8, as applicable to the release branch in use.