JetBrains Patches Critical Path-Traversal Flaw in IntelliJ IDEA, Five More Bugs Across TeamCity and YouTrack
JetBrains disclosed six vulnerabilities across IntelliJ IDEA, TeamCity, and YouTrack on July 16, led by a critical 9.8 CVSS path-traversal flaw in IntelliJ IDEA.
Editor's Note ·
- Correction:
- The article quotes GBHackers recommending administrators focus on "reviewing recent agent registrations, configuration changes, and access controls." GBHackers' actual wording is: "TeamCity administrators should also review recently registered build agents, pipeline and build-configuration modifications, Perforce integration settings, and unusual content displayed in cloud profiles."
- Correction:
- The article quotes Cyber Security News recommending administrators "review agent registration settings, audit pipeline changes, and examine access logs." The source's exact wording is: "review TeamCity agent registration settings, audit recent pipeline changes, and examine access logs for any unusual repository or file-access activity."
Overview
On July 16, 2026, JetBrains disclosed patches for six vulnerabilities spanning IntelliJ IDEA, TeamCity, and YouTrack, according to Cyber Security News and GBHackers. The most severe, CVE-2026-59792, is a critical code-execution flaw in IntelliJ IDEA caused by path traversal in how the IDE handles project workspace IDs, according to GBHackers, and carries a CVSS score of 9.8 according to the National Vulnerability Database.
What We Know
The IntelliJ IDEA flaw, tracked as CVE-2026-59792, stems from “improper path handling” (CWE-23) in how the IDE processes project workspace IDs, according to Cyber Security News. GBHackers described the mechanism in similar terms, reporting that “an attacker who can influence a vulnerable workspace ID may access files or write content outside the intended project workspace,” according to GBHackers. The National Vulnerability Database assigns the flaw a CVSS 3.1 score of 9.8 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and GBHackers credits the report to security researcher Antoni Tremblay, according to GBHackers. JetBrains fixed the issue in IntelliJ IDEA versions 2026.1.4 and 2026.2, according to Cyber Security News and GBHackers.
Four additional high-severity flaws affect TeamCity, all fixed in version 2026.1.2, according to Cyber Security News and GBHackers. CVE-2026-59793 is a file-access vulnerability in TeamCity’s Perforce version-control integration, reported by a researcher using the handle @maple3142, according to GBHackers; the National Vulnerability Database rates it 8.8 on the CVSS 3.1 scale, classifying the underlying issue as CWE-73, external control of file name or path. CVE-2026-59794 and CVE-2026-59795 are stored cross-site-scripting bugs — one reachable through TeamCity’s cloud profile page, the other through unauthenticated build-agent registration — with the agent-registration flaw reported by researcher Joakim Bulow, according to GBHackers. CVE-2026-59796, reported by a researcher known as Alwion, stems from insufficient permission checks that could let an attacker make unauthorized changes to TeamCity build pipelines, according to GBHackers.
The sixth flaw, CVE-2026-59791, is a low-severity CSS-injection vulnerability in YouTrack’s Mermaid diagram rendering, reported by a researcher going by Rohit Prasanth, or h3ri0s, according to GBHackers. JetBrains fixed it in YouTrack version 2026.2.17012, according to Cyber Security News and GBHackers.
Both outlets urge administrators to upgrade immediately to the patched versions. Cyber Security News recommends that administrators “review agent registration settings, audit pipeline changes, and examine access logs,” while GBHackers advises “reviewing recent agent registrations, configuration changes, and access controls.”
What We Don’t Know
Neither Cyber Security News nor GBHackers states whether any of the six flaws have been exploited in the wild. Neither outlet specifies how long each vulnerability existed in the affected products before it was reported to JetBrains.
Analysis
This is the second batch of significant JetBrains security patches in two weeks. On July 6, The Machine Herald reported that the company had fixed three critical authentication-bypass and account-takeover flaws in its Hub identity component, alongside separate code-execution bugs in IntelliJ IDEA, GoLand, and TeamCity — a batch JetBrains said it found through its own AI-assisted internal testing. The new disclosure covers an entirely different set of CVE identifiers, credited to external researchers rather than internal testing, underscoring how frequently vulnerabilities are surfacing across JetBrains’ IDE and CI/CD product line this summer. Because TeamCity sits at the center of many organizations’ build and deployment pipelines, the improper-authorization flaw tracked as CVE-2026-59796 is particularly notable: unauthorized modifications to a CI/CD pipeline can propagate directly into production software if left unpatched.