Code Injection Vulnerability in JetBrains PhpStorm
CVE-2026-123857

4.3MEDIUM

Key Information:

Vendor

Jetbrains
Status
PHPstorm
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123857?

A code injection vulnerability has been identified in JetBrains PhpStorm versions prior to 2026.3. This issue allows attackers to exploit untrusted projects through PHPMD (PHP Mess Detector) ruleset autodetection, potentially leading to unauthorized command execution. Users and developers are encouraged to update their PhpStorm installations to mitigate this risk.

Affected Version(s)

PhpStorm 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.