Code Upload Issues in JetBrains PhpStorm Affecting Untrusted Projects
CVE-2026-123858

4.4MEDIUM

Key Information:

Vendor

Jetbrains
Status
PHPstorm
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123858?

In JetBrains PhpStorm versions before 2026.3, there exists a significant security vulnerability that allows project files from untrusted sources to be automatically uploaded to a deployment server. This flaw can expose sensitive data and potentially compromise server integrity, as it does not adequately validate the trust level of project inputs before executing upload operations. Developers are advised to upgrade to the latest version to mitigate these risks.

Affected Version(s)

PhpStorm 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.