What is the CVSS score of EUVD-2026-48233?

EUVD-2026-48233 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Phpstorm are affected by EUVD-2026-48233?

PhpStorm versions before 2026.2 contain a critical flaw in their project trust model that allows arbitrary code execution when developers open untrusted projects, putting development teams at direct…. A patch is available.

How to fix or mitigate EUVD-2026-48233?

Within 24 hours, inventory all PhpStorm installations earlier than version 2026.2 across development teams and communicate this vulnerability advisory; simultaneously disable auto-execution features for project-level tooling and scripts in PhpStorm settings. Within 7 days, enforce policy requiring manual security review and explicit approval before developers open external repositories, configure PhpStorm to require explicit user trust approval for all projects, and deploy logging to detect suspicious child process execution from PhpStorm. Within 30 days, upgrade all affected PhpStorm installations to version 2026.2 or later once released by JetBrains, and conduct developer security training on identifying and reporting suspicious project structures.

Phpstorm EUVD-2026-48233

| CVE-2026-64808 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-23 cve@jetbrains.com

GHSA-m97h-r67f-cx3h

RCE Phpstorm JetBrains

8.4

CVSS 3.1 · Vendor: jetbrains

Severity by source

Vendor (jetbrains) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (jetbrains) · only source for this CVE.

CVSS VectorVendor: jetbrains

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:56 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.4

DescriptionCVE.org

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

AnalysisAI

Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.