Arbitrary Code Execution Vulnerability in JetBrains PhpStorm
CVE-2026-64808

8.4HIGH

Key Information:

Vendor

Jetbrains
Status
PHPstorm
Vendor
CVE Published:
23 July 2026

What is CVE-2026-64808?

In JetBrains PhpStorm prior to version 2026.2, users were at risk of arbitrary code execution due to insufficient trust management in project tooling before granting project trust. This vulnerability enables unauthorized actions within the application, posing significant risks for projects managed under PhpStorm. Users are recommended to upgrade to the latest version to mitigate exposure.

Affected Version(s)

PhpStorm 0 < 2026.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.