EUVD-2026-42910
GHSA-6f7v-4c46-hrp4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggered by loading a crafted project, so AV:L and UI:R rather than the NVD's AV:N/UI:N; code execution yields full C/I/A on the victim host.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
AnalysisAI
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper sanitization of the project workspace ID to write or reference files outside the intended workspace directory, culminating in arbitrary code execution. The flaw was self-reported by JetBrains and a fix is available; no public exploit has been identified at time of analysis. The NVD-assigned CVSS of 9.8 (network, no privileges, no user interaction) is notably high for a desktop IDE flaw and warrants scrutiny given that IDE project-handling bugs typically require a victim to open a crafted project.
Technical ContextAI
IntelliJ IDEA stores per-project metadata, including a workspace identifier, that the IDE resolves to on-disk paths when loading a project's state. The root cause is CWE-23 (Relative Path Traversal): the workspace ID value is used to construct a filesystem path without adequately neutralizing '../' sequences, so a crafted identifier can escape the intended workspace directory and reference or create files at attacker-chosen locations. Because IntelliJ executes build scripts, plugins, run configurations, and other code derived from project files, controlling a written path can be leveraged into code execution. The affected component per the CPE is cpe:2.3:a:jetbrains:intellij_idea across all editions/versions prior to the fixed builds.
RemediationAI
Vendor-released patch: upgrade to IntelliJ IDEA 2026.1.4 or later on the 2026.1 branch, and to the patched 2026.2 build, as published on the JetBrains Security page at https://www.jetbrains.com/privacy-security/issues-fixed/; the JetBrains Toolbox App or in-IDE update channel will deliver these. Until updated, do not open, import, or clone untrusted or unsolicited projects, and disable automatic project trust/reopen-last-project so that a malicious project is not loaded unattended - the trade-off is minor workflow friction from being prompted before each project loads. Where feasible, run the IDE under a least-privileged OS account and outside directories holding sensitive credentials to limit the blast radius of any path-traversal write. No workaround fully substitutes for the upgrade because the flaw is in core workspace-ID path handling.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today