What is the CVSS score of EUVD-2026-26368?

EUVD-2026-26368 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of IntelliJ IDEA are affected by EUVD-2026-26368?

CVE-2026-41882 affects IntelliJ IDEA's built-in web server, enabling remote attackers to read arbitrary files from developers' machines through network requests that require user interaction.. A patch is available.

How to fix or mitigate EUVD-2026-26368?

Within 24 hours: Inventory all IntelliJ IDEA installations and identify users running versions before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, or 2026.1.1. Within 7 days: Disable the built-in web server feature in vulnerable instances via Settings > Tools > Built-in Server or deploy network-level restrictions preventing external access to the web server port. Within 30 days: Upgrade all affected installations to patched versions (2024.3.7.1 or later in their respective release lines) and verify web server configuration post-upgrade.

IntelliJ IDEA EUVD-2026-26368

| CVE-2026-41882 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-04-30 JetBrains

Information Disclosure Intellij Idea

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 30, 2026 - 15:13 nvd

Patch available

Apr 30, 2026 - 13:01 EUVD

Analysis Generated

Apr 30, 2026 - 12:15 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 12:00 euvd

EUVD-2026-26368

Analysis Generated

Apr 30, 2026 - 12:00 vuln.today

CVE Published

Apr 30, 2026 - 11:05 nvd

HIGH 7.4

DescriptionCVE.org

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

AnalysisAI

Local file disclosure in IntelliJ IDEA's built-in web server allows remote attackers to read arbitrary local files via network requests requiring user interaction. JetBrains IDEA versions before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1 are affected. The vulnerability achieves scope change (CVSS S:C) enabling cross-context information theft with high confidentiality impact but no integrity or availability damage. No active exploitation (KEV-absent) or public POC identified at time of analysis, though vendor disclosure suggests controlled remediation timeline.

Technical ContextAI

The vulnerability stems from CWE-59 (Improper Link Resolution Before File Access, 'Link Following'), affecting JetBrains IntelliJ IDEA's built-in development web server. This embedded HTTP server, typically running on localhost during development workflows, failed to properly validate and sanitize file path requests. The CVSS scope change (S:C) indicates the vulnerable component (web server) can impact resources beyond its security scope, allowing attackers to access files outside the web server's intended document root. The attack leverages path traversal or symbolic link manipulation through specially crafted HTTP requests to the built-in server, exploiting insufficient canonicalization of file paths before access control checks. IntelliJ IDEA's web server is commonly used for live preview, debugging web applications, and serving static content during development-features that require file system access but demand strict sandboxing to prevent unauthorized file disclosure.

RemediationAI

Upgrade IntelliJ IDEA to the patched versions corresponding to your release branch: 2024.3.7.1 (for 2024.3.x users), 2025.1.7.1 (for 2025.1.x), 2025.2.6.2 (for 2025.2.x), 2025.3.4.1 (for 2025.3.x), or 2026.1.1 (for 2026.1.x early adopters). Updates are available through JetBrains Toolbox, in-IDE update mechanisms, or direct download from jetbrains.com. Consult the official security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for version-specific upgrade paths. If immediate patching is not feasible, disable the built-in web server when not actively needed via Settings > Build, Execution, Deployment > Debugger > Built-in server (uncheck 'Allow unsigned requests'). Note this mitigation breaks live preview and browser-based debugging workflows. Network-level controls provide limited protection given UI:R attack vector requires browser interaction rather than direct server exploitation. Organizations should prioritize patching developer workstations and audit for sensitive files inadvertently exposed if exploitation occurred during the vulnerability window.